asyncrat | 6eff2e306ad53860ccc4cb4fd5b12d766de2ec6c31e5625934c6c182be688ed4

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 17:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AU88.exe
Size 114KB
Sample260511-wg2trsf15x
SHA256 6eff2e306ad53860ccc4cb4fd5b12d766de2ec6c31e5625934c6c182be688ed4
MD5 2c8710c6139be3f41075f6e3871a0064
SHA1 ed9199db14c44f85fd4a50698ea13d242868612d
SHA512 65000a4df1f2a920468a6e8985dcfa0e0061a8b1475e53726416e85f3b42c7f4bcd66d4f9098547188c87198285a8a1508fa7c33ede5db7a63b1f48bef7223c0
SSDEEP 1536:juNz1Tts426iXCEy9kMZZy3kb3e8JjQ3Xid7Hwoju4339Lv:juNxTts42CEy9JZZrb39qyhNFv
TLSH
T193B383502A45C21ED12E1AFEB892C3314325EE561D02DE4A28C4AD537533BBEC9767EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vipbookssearch.radio.fm:80
vipbookssearch.radio.fm:443
vipbookssearch.radio.fm:8080
vipbookssearch.radio.fm:8443
vipbookssearch.radio.fm:21
www.vipbookssearch.radio.fm:80
www.vipbookssearch.radio.fm:443
www.vipbookssearch.radio.fm:8080
www.vipbookssearch.radio.fm:8443
www.vipbookssearch.radio.fm:21
admin.vipbookssearch.radio.fm:80
admin.vipbookssearch.radio.fm:443
admin.vipbookssearch.radio.fm:8080
admin.vipbookssearch.radio.fm:8443
admin.vipbookssearch.radio.fm:21

Mutex

TpYFNuD23lKE

Attributes

delay
3
install
true
install_file
AU88x.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x002700000002b207-9.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
1344	AU88x.exe
1660	AU88x.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AU88x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AU88x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AU88.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3168	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe
1316	AU88.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	AU88.exe
Token: SeDebugPrivilege	1344	AU88x.exe
Token: SeDebugPrivilege	1344	AU88x.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 864	1316	AU88.exe	80
PID 1316 wrote to memory of 3044	1316	AU88.exe	82
PID 3044 wrote to memory of 3168	3044	cmd.exe	84
PID 864 wrote to memory of 1152	864	cmd.exe	85
PID 3044 wrote to memory of 1660	3044	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\AU88.exe
"C:\Users\Admin\AppData\Local\Temp\AU88.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AU88x" /tr '"C:\Users\Admin\AppData\Roaming\AU88x.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "AU88x" /tr '"C:\Users\Admin\AppData\Roaming\AU88x.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp21AC.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3168
- - C:\Users\Admin\AppData\Roaming\AU88x.exe
    "C:\Users\Admin\AppData\Roaming\AU88x.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1660

C:\Users\Admin\AppData\Roaming\AU88x.exe
"C:\Users\Admin\AppData\Roaming\AU88x.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp21AC.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp21AC.tmp.bat
Size 149B
SHA256 6fc846fc9b97f3e7348497e67374e9c9c3890f7f64c08c0fafaea1fa8169ed5e
MD5 3964b65456d2aa954dd15bd7d5ce78b7
SHA1 a806b669d08596c53db7ee770d776f9538bf862a
SHA512 b1b9b6f57745315910eae2dd4f9720072be121ca9d2061a0e297cc20d0316f641bcb56f34ce435e05b1b9e8e34897e57219ba19c0cfcadce2369836d728ff353
TLSH
T13EC02B5271CAFB1E2C45141303FED48C9172AC1D3F40BF50C308840D1280448F5DA381
MD5 SHA1 SHA512 TLSH

Submit Download

AU88x.exe

Path C:\Users\Admin\AppData\Roaming\AU88x.exe
Size 114KB
SHA256 6eff2e306ad53860ccc4cb4fd5b12d766de2ec6c31e5625934c6c182be688ed4
MD5 2c8710c6139be3f41075f6e3871a0064
SHA1 ed9199db14c44f85fd4a50698ea13d242868612d
SHA512 65000a4df1f2a920468a6e8985dcfa0e0061a8b1475e53726416e85f3b42c7f4bcd66d4f9098547188c87198285a8a1508fa7c33ede5db7a63b1f48bef7223c0
SSDEEP 1536:juNz1Tts426iXCEy9kMZZy3kb3e8JjQ3Xid7Hwoju4339Lv:juNxTts42CEy9JZZrb39qyhNFv
TLSH
T193B383502A45C21ED12E1AFEB892C3314325EE561D02DE4A28C4AD537533BBEC9767EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1316-0-0x00000000006F0000-0x0000000000712000-memory.dmp

Download

memory/1316-1-0x00000000052F0000-0x0000000005300000-memory.dmp

Download

memory/1316-2-0x00000000051F0000-0x000000000528C000-memory.dmp

Download

memory/1316-7-0x0000000001140000-0x00000000012EC000-memory.dmp

Download

memory/1344-16-0x0000000005140000-0x00000000051A4000-memory.dmp

Download

memory/1344-15-0x0000000001090000-0x000000000123C000-memory.dmp

Download

memory/1660-14-0x00000000018D0000-0x0000000001A7C000-memory.dmp

Download

memory/3168-11-0x0000000000A90000-0x0000000000AF4000-memory.dmp

Download