asyncrat | 634dcc15da346148ebe64c961641d0ad119c460c2b8852bc2a5ee6170b225fa6

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mko1.exe
Size 75KB
Sample260601-bhpklsay2t
SHA256 634dcc15da346148ebe64c961641d0ad119c460c2b8852bc2a5ee6170b225fa6
MD5 0352d35562640b018bf07813fad9fd96
SHA1 00c2f8c2e52fbc40489f7826c78c1a9007789864
SHA512 25d435a58c3cd6ef74b6deda5cf5f163e458681c1a4db12ac300288e92b91e74c5a8f5ce81bbf201a920baf5287fda40861fd432b3583d4d3457c2d71570185a
SSDEEP 1536:lKGusnuYu2bsEofWB9H7Z8J6OreZ5/EAH5aimVcl:ljnnu2bs8V6JXoltHMi8Y
TLSH
T1747339302FD8426DF1B9DE7478A13271CE7AAD372D0EFD1AEC8434860E367858A51DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

null defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

789win.us.com:80
789win.us.com:8080
789win.us.com:443
789win.us.com:8443
789win.us.com:22
789win.us.com:6607
789win.us.com:23

Mutex

lejkytfotaniitj

Attributes

delay
5
install
true
install_file
ChromeUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Executes dropped EXE 2 IoCs

pid	Process
5252	ChromeUpdate.exe
1848	ChromeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5756	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4072	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
2372	mko1.exe
5252	ChromeUpdate.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	mko1.exe
Token: SeDebugPrivilege	5252	ChromeUpdate.exe
Token: SeDebugPrivilege	5252	ChromeUpdate.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4072	2372	mko1.exe	82
PID 2372 wrote to memory of 2856	2372	mko1.exe	84
PID 2856 wrote to memory of 5756	2856	cmd.exe	86
PID 2856 wrote to memory of 1848	2856	cmd.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\mko1.exe
"C:\Users\Admin\AppData\Local\Temp\mko1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'ChromeUpdate"' /tr "'C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7F3D.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:5756
- - C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
    "C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
    3⤵
    - Executes dropped EXE
    PID:1848

C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
"C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp7F3D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7F3D.tmp.bat
Size 156B
SHA256 01e201b871ff4b9e13ce35f3a4125ab22fda352fdaf29f2b877691e2ed3ba92a
MD5 677fb8be5ceee2f7ca98c176842029f1
SHA1 a29a84e48b348cfce8796084048318b91088e4b5
SHA512 fb9a7d557384243816a8f08f1d362233e2669dc7d10204f18a381a7592bad534cd44553178d4662bf429dba855259f838af04aa8a89c1b2d0bb93edfa96f19ca
TLSH
T16BC02B4251C5EE1E2805A41306FED4CC97B37C5A3F48BF00C304441E6280948F8DD382
MD5 SHA1 SHA512 TLSH

Submit Download

ChromeUpdate.exe

Path C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
Size 43.5MB
SHA256 c6b7597df284022fd3141c97371fc5df9839271ac483c5657f25f224dbec1fbf
MD5 464206cfdf09a16cabdb5706469d0c4d
SHA1 597465d4abb853f75367b06ade2dcd92e002da74
SHA512 3dd5d101c3f75f838d52a30693f1f98e4e6e18a4ea43a0074b592f145231abac2a11d0c6e6f776a21a6079c3e55207cd0b77971430df4147d085c0c3f742a0c6
SSDEEP 786432:7eKwmHi97iW9n50zipljlrjtbu45zfP58YnRsuuuKpWt7+Juuh3W:aDf9+A573pu45zfBjRsulgqCJFW
TLSH
T147A7332829150508F3EBDDF875859066AE244FFE4F18D2A5D87EB3B91531AF22E8CCD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2372-0-0x0000000000460000-0x0000000000478000-memory.dmp

Download

memory/2372-1-0x0000000000CB0000-0x0000000000CC0000-memory.dmp

Download

memory/2372-2-0x0000000000CB0000-0x0000000000CC0000-memory.dmp

Download