asyncrat | 869922c2066ce3950fea8639d597e4a1ff9efa12b9cc4649b22ec1dc742612bc

Analysis

user interaction
yes
max time kernel
342s
max time network
352s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinNetSvc_e4a53f.exe
Size 202.7MB
Sample260418-phcspsht6q
SHA256 869922c2066ce3950fea8639d597e4a1ff9efa12b9cc4649b22ec1dc742612bc
MD5 6393a9b9173d447feda7166c5b605876
SHA1 09384613a83e1525d11baa0f994f09d653c6e759
SHA512 27b62ce2165a9e88915f9b6cd93878ce93a9c6ec0dcddc229729aaf28760d0761982ce547f89ec90a1ed9c0934825640f2ae28ae1faca6519ca9526e67177a0b
SSDEEP 3145728:6VPnE9X6KPuUxWacIC0Jh1W6zODQ9NqguZgnNR5hKe6Ls+4HXQNvqq:n9X6KPuTacCJG6IC/+s+Mcqq
TLSH
T131A8CF1163E86E45E27B8278977782A1D6B5BC525311C2CF0094FD4A3F73BC2BA36366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution asyncrat stormkitty persistence rat stealer

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral3/files/0x0003000000024f91-42.dat	family_asyncrat

StormKitty payload 2 IoCs

resource	yara_rule
behavioral3/files/0x0003000000024f91-42.dat	family_stormkitty
behavioral3/memory/3048-44-0x0000000000670000-0x00000000009BA000-memory.dmp	family_stormkitty

Executes dropped EXE 6 IoCs

pid	Process
2628	WinNetSvc_a97ce7.exe
3048	almohtraf.exe
4060	almtmiz.exe
376	almtmiz.exe
1708	WinNetSvc_287c66.exe
4432	almohtraf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4384	cmd.exe

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
232	timeout.exe
2468	timeout.exe
2100	timeout.exe
3820	timeout.exe
2984	timeout.exe
3068	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1000	taskkill.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
3048	almohtraf.exe
4060	almtmiz.exe
4060	almtmiz.exe
4060	almtmiz.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2768	WinNetSvc_e4a53f.exe
Token: SeDebugPrivilege	2628	WinNetSvc_a97ce7.exe
Token: SeDebugPrivilege	3048	almohtraf.exe
Token: SeDebugPrivilege	4060	almtmiz.exe
Token: SeDebugPrivilege	1000	taskkill.exe
Token: SeDebugPrivilege	1708	WinNetSvc_287c66.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2768	WinNetSvc_e4a53f.exe
2768	WinNetSvc_e4a53f.exe
2628	WinNetSvc_a97ce7.exe
2628	WinNetSvc_a97ce7.exe
4060	almtmiz.exe
1708	WinNetSvc_287c66.exe
1708	WinNetSvc_287c66.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2628	2768	WinNetSvc_e4a53f.exe	80
PID 2768 wrote to memory of 5056	2768	WinNetSvc_e4a53f.exe	81
PID 5056 wrote to memory of 232	5056	cmd.exe	83
PID 5056 wrote to memory of 2428	5056	cmd.exe	84
PID 2428 wrote to memory of 3144	2428	net.exe	85
PID 5056 wrote to memory of 4448	5056	cmd.exe	86
PID 5056 wrote to memory of 2468	5056	cmd.exe	87
PID 5056 wrote to memory of 3048	5056	cmd.exe	88
PID 3048 wrote to memory of 1676	3048	almohtraf.exe	90
PID 3048 wrote to memory of 4104	3048	almohtraf.exe	92
PID 4104 wrote to memory of 2100	4104	cmd.exe	94
PID 1676 wrote to memory of 3864	1676	cmd.exe	95
PID 4104 wrote to memory of 376	4104	cmd.exe	98
PID 2628 wrote to memory of 4384	2628	WinNetSvc_a97ce7.exe	99
PID 4384 wrote to memory of 1000	4384	cmd.exe	101
PID 4384 wrote to memory of 3820	4384	cmd.exe	102
PID 2628 wrote to memory of 1708	2628	WinNetSvc_a97ce7.exe	103
PID 2628 wrote to memory of 3772	2628	WinNetSvc_a97ce7.exe	104
PID 3772 wrote to memory of 2984	3772	cmd.exe	106
PID 3772 wrote to memory of 1512	3772	cmd.exe	107
PID 1512 wrote to memory of 3828	1512	net.exe	108
PID 3772 wrote to memory of 1044	3772	cmd.exe	109
PID 3772 wrote to memory of 3068	3772	cmd.exe	110
PID 3772 wrote to memory of 4432	3772	cmd.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WinNetSvc_e4a53f.exe
"C:\Users\Admin\AppData\Local\Temp\WinNetSvc_e4a53f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\WinNetSvc_a97ce7.exe
  "C:\Users\Admin\AppData\Local\Temp\WinNetSvc_a97ce7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c taskkill /F /IM "WinNetSvc_e4a53f.exe" & timeout /t 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\WinNetSvc_e4a53f.exe"
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "WinNetSvc_e4a53f.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1000
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:3820
- - C:\Users\Admin\AppData\Local\Temp\WinNetSvc_287c66.exe
    "C:\Users\Admin\AppData\Local\Temp\WinNetSvc_287c66.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1708
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c timeout /t 10 && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Windows\system32\timeout.exe
      timeout /t 10
      4⤵
      Delays execution with timeout.exe
      PID:2984
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1512
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3828
  - - C:\Windows\system32\schtasks.exe
      schtasks /Delete /TN "WinServiceSyncTask" /F
      4⤵
      PID:1044
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3068
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.exe
      "almohtraf.exe"
      4⤵
      Executes dropped EXE
      PID:4432
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c timeout /t 10 && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:232
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3144
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "WinServiceSyncTask" /F
    3⤵
    PID:4448
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2468
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.exe
    "almohtraf.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "almtmiz" /tr '"C:\Users\Admin\AppData\Roaming\almtmiz.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "almtmiz" /tr '"C:\Users\Admin\AppData\Roaming\almtmiz.exe"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC45B.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4104
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2100
    - - C:\Users\Admin\AppData\Roaming\almtmiz.exe
        
        "C:\Users\Admin\AppData\Roaming\almtmiz.exe"
        5⤵
        Executes dropped EXE
        
        PID:376

C:\Users\Admin\AppData\Roaming\almtmiz.exe
"C:\Users\Admin\AppData\Roaming\almtmiz.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

almohtraf.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\almohtraf.exe.log
Size 1KB
SHA256 27580155f70a856612c712e4813b49c1c0b505ef55e9846e009fb45b7baef2b7
MD5 67c05cf6fe5179a137c80322a586092d
SHA1 0547eac3eb017cdc3267181c656efcac6e5fe364
SHA512 6be26fdba88297d5cf91e2d4bde06d6e434f93dfe879e93c711de6f276740bcae76fb312cccf3ccaa2bd10535993a4af3481f53363c321693d3467f0f1abde5c
TLSH
T12F3169722372B1D889163F43186D568817FF4329B550EE0CB998A25ED92741B6F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

tmpC45B.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpC45B.tmp.bat
Size 151B
SHA256 7e0a29ee42c790ff8821a207e631f3dfb0dc524a2eae27539be9aa7bc716cf6e
MD5 d37af053210208ae2a10a38092c4716a
SHA1 f2ab1b77aeb58160176bceb928209bc0b5fc4705
SHA512 6697cc0bc121168ea3b7b776f6caad02ad57770d0766c7108b2d5dd08b4a43422abc38770f4021832ee06e469ebf8a028fa8026f88ae72d497ae7310948c9cc4
TLSH
T125C02B426AC5EB5EBA05542702FBD4CEB1726D1A3F40BF00C384404D1681488F0D9341
MD5 SHA1 SHA512 TLSH

Submit Download

wko5qnz1.s4x

Path C:\Users\Admin\AppData\Local\Temp\wko5qnz1.s4x
Size 474B
SHA256 240098e7033b5f20c8c5936ecb68cc1049f1ecc34af536995b52a93175249150
MD5 46f522c77d1a514703a7fed0015fc623
SHA1 ed22f0a5884ff7445f4e171e1e49e0af608e0fda
SHA512 09aec723bf6f79c3926300c64b9b70f67d7190fcb75d53b32ffd2d4803515dabb014cab50cf2924a366c0c73ac2187c4a393790cdf3d4b989146f6b310d3c90f
TLSH
T1BCF02E00C4D4E976477205913FEBF510576D132304C90A4578A4BDA79F955D64947075
MD5 SHA1 SHA512 TLSH

Submit Download

almohtraf.bat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.bat
Size 988B
SHA256 d710692ad33516739d9d492d494fb87054559d51f9f5de117dc9675d74d41c5c
MD5 684c0e1e40451ca9da7ec67358b53f01
SHA1 9a96498fadde3c37adeb142df1a58d2e12b1f24e
SHA512 0784137761157f370769ade0d27b6e4535c32c5cfedd085298521078660e979c93c7825246be58cbcf52f5eed5a215ca11ef27f23fe7c041c0d7676422eba53f
TLSH
T1341125511D2644121353BD76C2533455F4B99E131E16E458F4D350904FBF286D5CE6F6
MD5 SHA1 SHA512 TLSH

Submit Download

almohtraf.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\Bin\almohtraf.exe
Size 3.3MB
SHA256 8ce93a19ce487452698e76a063759f89281d241dc51bf2b2e62c6ed275dbfaaf
MD5 26280b3a6e26806d41644e9d6a54456e
SHA1 1c3d412f08b536744be948db3fb53b64050022a3
SHA512 72d97cb072192d56a01a610ae42b01d959a6fbcb9694393125e4ae2476fdf61f7699dbd630b2d73b6c02cca072742c5b8442366d87a90b9666984cf403c767e8
SSDEEP 49152:geMAR4e3jG7Pk12ShzPMAzU0mdBdo+6WuDayPtr/NJJc:gQ3y7TS9x
TLSH
T1F5F54B416BE8CE1BE1BF2775A4F201111BB1E449A732D78F1698E6792C637406D0A3BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkg_data.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NetworkCache\pkg_data.dat
Size 1.2MB
SHA256 414a476d837174d49bdce2beb21122c0c2614995265ad1e449af24994ac8ac6e
MD5 b6bb6505753219910b71c0ebcb2204af
SHA1 ae70e7e5cc7bc40bac554f4f18ea75025aa2a013
SHA512 eaab812532187cfdfe31e0b0121a9ca73f441cafb56e2f493fb4ea645d743c79ca894cb9d73a4e7f719ce7763b14b000f4519fa5149ba8aaf69e84b3877fc717
SSDEEP 24576:zlHC8sAUGwQVqI0Gk/TPgsZQMUxR+nO37/Z0NTtjny:EzI0d0sZQMUeO/Zgjny
TLSH
T1B84533534B7B0FC6B1F16AB5E9F44B43F58FD622987A35A719023FAF11042ECA5B4488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/376-57-0x0000000002880000-0x000000000292F000-memory.dmp

Download

memory/1000-89-0x000002BAFEC70000-0x000002BAFED1F000-memory.dmp

Download

memory/1708-119-0x0000024329430000-0x00000243294DF000-memory.dmp

Download

memory/2628-39-0x000002576DD20000-0x000002576DDCF000-memory.dmp

Download

memory/2628-118-0x000002576DD20000-0x000002576DDCF000-memory.dmp

Download

memory/2768-2-0x000001CAACB20000-0x000001CAACBCF000-memory.dmp

Download

memory/2768-38-0x000001CAACB20000-0x000001CAACBCF000-memory.dmp

Download

memory/3048-44-0x0000000000670000-0x00000000009BA000-memory.dmp

Download

memory/3048-51-0x0000000002A80000-0x0000000002A92000-memory.dmp

Download

memory/3048-50-0x000000001B710000-0x000000001B7BF000-memory.dmp

Download

memory/4060-62-0x000000001BDA0000-0x000000001BE4F000-memory.dmp

Download

memory/4060-63-0x0000000002ED0000-0x0000000002EE2000-memory.dmp

Download

memory/4060-60-0x000000001C740000-0x000000001C762000-memory.dmp

Download

memory/4432-130-0x0000000002F10000-0x0000000002FBF000-memory.dmp

Download