asyncrat | b53580902b61d1984f488be6308ecc3d48ad7534722f5c9411a878d479a15161

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mko2.exe
Size 75KB
Sample260525-mcy3msgw4w
SHA256 b53580902b61d1984f488be6308ecc3d48ad7534722f5c9411a878d479a15161
MD5 8e650a91fde6ba5d271ffa1e1be9829d
SHA1 84c8605978fe17feb75f55ef394ec6a475e8067b
SHA512 63dd5ec15d133d2df0a640c609b41c44cd69ef187b48b9abfc2a9923f4efd623baa3948504a29dc8fa0f47656f75d632cce5c08d298439c483071f29503da9fd
SSDEEP 1536:VKGuzvDS71biB+acHVW/ngOl6O0eZ5/EAH5rKmVcl:VovO71biB+z4/ngAooltH5K8Y
TLSH
T1457319302FD942AEF1B9CE7478A13171CE76AD772E0EFD1AEC8434860E327858641DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

null defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

scndo.sa.com:80
scndo.sa.com:8080
scndo.sa.com:443
scndo.sa.com:8443
scndo.sa.com:22
scndo.sa.com:6607
scndo.sa.com:23

Mutex

lejkytfotaniitj

Attributes

delay
2
install
true
install_file
ChromeUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Executes dropped EXE 1 IoCs

pid	Process
4808	ChromeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1092	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
1644	mko2.exe
4808	ChromeUpdate.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	mko2.exe
Token: SeDebugPrivilege	4808	ChromeUpdate.exe
Token: SeDebugPrivilege	4808	ChromeUpdate.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 3372	1644	mko2.exe	82
PID 1644 wrote to memory of 3284	1644	mko2.exe	85
PID 3284 wrote to memory of 1092	3284	cmd.exe	87
PID 3284 wrote to memory of 4808	3284	cmd.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\mko2.exe
"C:\Users\Admin\AppData\Local\Temp\mko2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'ChromeUpdate"' /tr "'C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp56F5.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1092
- - C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
    "C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp56F5.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp56F5.tmp.bat
Size 156B
SHA256 948ffbd6492f61c447a01dcd558a1a6231eeb38dae82af1989de3fe2497d627e
MD5 6feb638760e344f157e8e4a535e12139
SHA1 883c0694e26dd9ed41169673526122604015766d
SHA512 1868d65c8fca17ac6d0c60d281e8e7bb9270e2a33935644655ff0f355b3f3eb7e7a27dc820014ca5a9cdc4b5a134a438b4cb55afb83712b82fc59496d257b940
TLSH
T170C02B4291C5EE1E2809B42303FAD9CCA5B26DAB3F48BF00C308880F7280888F4DD382
MD5 SHA1 SHA512 TLSH

Submit Download

ChromeUpdate.exe

Path C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
Size 40.0MB
SHA256 737ea89930c0272cffa0d296c534e42726353fdcaa26c9bfcec517fe603d098f
MD5 474a0203412d8fa660fe3a74a0f48e98
SHA1 72f81a90e54790a1e62e29ce518b91bddb1b57f2
SHA512 0dcd17c291b1730f1266177db85ddba593b01b0d9b3c0f0bc8523ef134065e79737c80af988a76f95a443a5739881730f0ff2fd80ca807137dce84d7c36c9bd5
SSDEEP 786432:cbQPfTOYglkqJJDSpVheSR2cTWaWrNpHUCwUTxLeVovP:cMfyxJDcjeSRPaaWrNlUCwS
TLSH
T18497337908DC6CDCC10CAF39F4542BB99FE8DA77788FF8C4C214149EA8B65425D78A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1644-0-0x00000000005B0000-0x00000000005C8000-memory.dmp

Download

memory/1644-1-0x000000001C850000-0x000000001C860000-memory.dmp

Download

memory/1644-2-0x000000001C850000-0x000000001C860000-memory.dmp

Download