asyncrat | 3d4f5d2ad620a67464486b5517d3cef27121957c20ac78bbd51c4d2a7fc16f9b

Analysis

user interaction
yes
max time kernel
58s
max time network
56s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LOL.exe
Size 328KB
Sample260605-lwcs3set7m
SHA256 3d4f5d2ad620a67464486b5517d3cef27121957c20ac78bbd51c4d2a7fc16f9b
MD5 fd8d5a4f373f67fc4e0fe4d3d77555b6
SHA1 910f2cf23fe2278fea994a89ece5dbefb55da5b5
SHA512 23769f3e064f946e995acdad2ee3cfb76cd1fd323c3829be192f82319e8c456c9915fe1e4b9319ce2394cde8ff8764201a434a9b8240760a272887ffc0361d5b
SSDEEP 1536:/Ox2Mbga92D7EKbbd2VYQUK6ORxuwKmVcl:/Kbga92D7EKbbgVYQHPK8Y
TLSH
T1B16490463B5E821FD37B1A784A96D107D574FD0E3A22CD17BD4C325D3B33687A8912A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

null defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

woodworkersolution.com:80
woodworkersolution.com:8080
woodworkersolution.com:443
woodworkersolution.com:8443
woodworkersolution.com:22
woodworkersolution.com:6607
woodworkersolution.com:23

Mutex

lejkytfotaniitj

Attributes

delay
3
install
true
install_file
ChromeUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Executes dropped EXE 2 IoCs

pid	Process
3464	ChromeUpdate.exe
3644	ChromeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2836	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3940	LOL.exe
3464	ChromeUpdate.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	LOL.exe
Token: SeDebugPrivilege	3464	ChromeUpdate.exe
Token: SeDebugPrivilege	3464	ChromeUpdate.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 3156	3940	LOL.exe	81
PID 3940 wrote to memory of 4232	3940	LOL.exe	83
PID 4232 wrote to memory of 2836	4232	cmd.exe	85
PID 4232 wrote to memory of 3644	4232	cmd.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\LOL.exe
"C:\Users\Admin\AppData\Local\Temp\LOL.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'ChromeUpdate"' /tr "'C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4C75.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2836
- - C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
    "C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
    3⤵
    - Executes dropped EXE
    PID:3644

C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
"C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4C75.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4C75.tmp.bat
Size 156B
SHA256 b6a0c1c53e812d46410fdb9f075caded1e63e19941e8f1f0e1b60ece250e2726
MD5 213c9d82a5b0aa060de48a1e504e9116
SHA1 e0b04014ab7535a91321dd28877ad8a3a4dae536
SHA512 95aafb5932cf1b48ad807f3cef45dc5f0680ba3e5adb30c2c3253a9d9924f747e4c7b80712a54632bc762e9d92d8dde809605b8568227decdf79d1bb752b7bd5
TLSH
T1F1C02B8251C6EE2F2905741303FAD4CC95B66C6A3F89FF10C304444E62808C8F4DE382
MD5 SHA1 SHA512 TLSH

Submit Download

ChromeUpdate.exe

Path C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
Size 44.9MB
SHA256 c281a2765fc4a64a975bbdbd361d0bb00805b1f2b12158e92db5432496e6183f
MD5 d1d58f88a47e937db1beb1f6e805ceab
SHA1 e12e721e91a3e4f223d1f60a0bc46652bd715257
SHA512 48c131b1a0e9048aa76a588b81e5ff594c597de7c8e059b7190ba7f188bd9e156beab0555a4dff0dd107ff94ed58fccd2c42d4075012cc7b4e74fe49d00f7e1d
SSDEEP 786432:l182AJbUyr9up69NPPTjH62Z5Ln3j9OYeGLCzDt/rBfCgpWXpjcAjgAsh6z9:4VD9g69NPPX/xeGwTLpWXpfE/65
TLSH
T1B9A73301B99F465FE3FB16B8909842B7CC6A761E7306CE03758C2B5E3A736171C93896
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3940-0-0x00000000004E0000-0x0000000000538000-memory.dmp

Download

memory/3940-1-0x000000001C830000-0x000000001C840000-memory.dmp

Download

memory/3940-2-0x000000001C830000-0x000000001C840000-memory.dmp

Download