asyncrat | e4910d01674833f312909d122445f84c3ae40f6f8430d19e731e9564ee9f9f9e

Analysis

user interaction
yes
max time kernel
59s
max time network
59s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svchost.exe
Size 75KB
Sample260601-bctx5sax3x
SHA256 e4910d01674833f312909d122445f84c3ae40f6f8430d19e731e9564ee9f9f9e
MD5 14a71661255f6729a8cd96fdda148afa
SHA1 884b05fed123df06be233e572a924f0ca79428c8
SHA512 15fac7a1e0cc668330f47476cbac09e287a909cce6033e5d299d8237e9eba84d5482e56bbb3b1a1b7eb73956f75455b141351669e677740908f4056d09562c87
SSDEEP 1536:hKGuLgFv5+ZHfb8nLGshEmX6ODeZ5/EAH5aimVcl:hNFvEZHfb8nRfoltHMi8Y
TLSH
T1A07318302FD942ADF1B9CE7478A13171CE7AAD372D0EF91AEC8434861E327898651DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

null defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

gou.us.com:80
gou.us.com:8080
gou.us.com:443
gou.us.com:8443
gou.us.com:22
gou.us.com:6607
gou.us.com:23

Mutex

lejkytfotaniitj

Attributes

delay
3
install
true
install_file
ChromeUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Executes dropped EXE 1 IoCs

pid	Process
5884	ChromeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5532	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
3024	svchost.exe
5884	ChromeUpdate.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	svchost.exe
Token: SeDebugPrivilege	5884	ChromeUpdate.exe
Token: SeDebugPrivilege	5884	ChromeUpdate.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2100	3024	svchost.exe	81
PID 3024 wrote to memory of 2732	3024	svchost.exe	84
PID 2732 wrote to memory of 5532	2732	cmd.exe	86
PID 2732 wrote to memory of 5884	2732	cmd.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'ChromeUpdate"' /tr "'C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp66B4.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:5532
- - C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
    "C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp66B4.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp66B4.tmp.bat
Size 156B
SHA256 99483c2d46060d8978ca3de6ac2b9867bab0d88484e7e1e98dad4df55dbc4e31
MD5 a8b3c370256f625f35ae42f6207cde64
SHA1 302dddfef51e187726b7ddb44cff5e24db25e4bc
SHA512 f34a23e1e2c6a6f2433ccfce0cbd629d5025196edb8b1409b4d1a05e53ce784792b2de6701ec2883c028f6f928b17183a77980255fefea9aa7e8946e7410f2b2
TLSH
T1B9C02B4251C5EE9E2805745702FBD5CC95B2BC5E3F48BF10C304440F6680888F4DD386
MD5 SHA1 SHA512 TLSH

Submit Download

ChromeUpdate.exe

Path C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
Size 45.3MB
SHA256 2712804ebc9a83bc37acd9c379fb98cf9ed40642fdd094359875a0b7b4a4423d
MD5 e2d1da6971f87b9b9a933da96ce6774d
SHA1 1e1f4d8aa7e6b10308faa56ceaa8addaba395758
SHA512 8fa00a9387d19227beb7e185fd0c48e96d9b9d594b47c466f61092606e2fc2b9c88e3d3e7b2aac94d3c3eebd53e73fee976cc4fe7bc5e53f2f66c707d6a89580
SSDEEP 786432:fi7gmIQd3dTOSMlYbwEzAtXP8GuwN/GmtJEhr5GhbNXJVh1KatTmhLn:aEmI4NTQlY1Anji5Abd/TKXhLn
TLSH
T1D7A7333802B4654DC4ABA8B061BA29C1C5B9A3967D0CF312FC66AC913EF5D1CDE1E94D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3024-0-0x0000000000FB0000-0x0000000000FC8000-memory.dmp

Download