asyncrat | fabccbd0f03d5ff9c095aeac1046a515a9ddcf5ecf154547619e9516c546d8dd

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Infected.exe
Size 63KB
Sample260623-qlmmrac16p
SHA256 fabccbd0f03d5ff9c095aeac1046a515a9ddcf5ecf154547619e9516c546d8dd
MD5 7a949c7a162daacad891891c7b5b0831
SHA1 d8eb62bb8ebc0700619e2963a2303af86d35adca
SHA512 c26d7cccd459c3dc903d54d6cd4236b829285a25af84585670acbbc443b0e973698953ee3045c890013576ad4b326e1e1015f4bba2fbc829e352699a18b3236f
SSDEEP 768:lPiSXUp6e78QfC8A+Xi+azcBRL5JTk1+T4KSBGHmDbD/ph0oXrkttrLo6mssbucx:cD6yddSJYUbdh9oTLXKubuHdpqKmY7
TLSH
T1E2536C013798CA66E2AE47B8BCF3550106B1D1772112DA1E7CC810DB6BAFFC656126FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xgroup defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Botnet

xgroup

hubscore.io:3232
hubscore.io:3333
hubscore.io:443
hubscore.io:8090
hubscore.io:53
hubscore.io:5353
hubscore.io:22
hubscore.io:25
hubscore.io:465
hubscore.io:587
hubscore.io:8080
www.hubscore.io:3232
www.hubscore.io:3333
www.hubscore.io:443
www.hubscore.io:8090
www.hubscore.io:53
www.hubscore.io:5353
www.hubscore.io:22
www.hubscore.io:25
www.hubscore.io:465
www.hubscore.io:587
www.hubscore.io:8080

Attributes

delay
1
install
true
install_file
tamper.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001000000001c646-9.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2952	tamper.exe
5060	tamper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4212	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
4772	Infected.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe
2952	tamper.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	Infected.exe
Token: SeDebugPrivilege	4772	Infected.exe
Token: SeDebugPrivilege	2952	tamper.exe
Token: SeDebugPrivilege	2952	tamper.exe
Token: SeDebugPrivilege	5060	tamper.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 1296	4772	Infected.exe	90
PID 4772 wrote to memory of 1324	4772	Infected.exe	92
PID 1296 wrote to memory of 2592	1296	cmd.exe	94
PID 1324 wrote to memory of 4212	1324	cmd.exe	95
PID 1324 wrote to memory of 5060	1324	cmd.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Infected.exe
"C:\Users\Admin\AppData\Local\Temp\Infected.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "tamper" /tr '"C:\Users\Admin\AppData\Roaming\tamper.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "tamper" /tr '"C:\Users\Admin\AppData\Roaming\tamper.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5BF6.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4212
- - C:\Users\Admin\AppData\Roaming\tamper.exe
    "C:\Users\Admin\AppData\Roaming\tamper.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5060

C:\Users\Admin\AppData\Roaming\tamper.exe
"C:\Users\Admin\AppData\Roaming\tamper.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5BF6.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp5BF6.tmp.bat
Size 150B
SHA256 234fc4f238176a63de52435de7118455816b1f31d9af348920a58c37c3feca8c
MD5 b3cadd86c84e7aaf9240d749461dda8d
SHA1 224c7fab7adadf72b074596aa191674b92dbf893
SHA512 02d2d8613e5fcf01ae529a25798f53daddc0633c3317f2a5e4cd56269c8eeaa758dbed520ff5bba967397414e88d932700744569b93fb2346bc12c27bdc51122
TLSH
T13DC02B4392CAEA0F3805182302FAD9CDA1726C2A3F44FB00D348460E628044CF0ED381
MD5 SHA1 SHA512 TLSH

Submit Download

tamper.exe

Path C:\Users\Admin\AppData\Roaming\tamper.exe
Size 63KB
SHA256 fabccbd0f03d5ff9c095aeac1046a515a9ddcf5ecf154547619e9516c546d8dd
MD5 7a949c7a162daacad891891c7b5b0831
SHA1 d8eb62bb8ebc0700619e2963a2303af86d35adca
SHA512 c26d7cccd459c3dc903d54d6cd4236b829285a25af84585670acbbc443b0e973698953ee3045c890013576ad4b326e1e1015f4bba2fbc829e352699a18b3236f
SSDEEP 768:lPiSXUp6e78QfC8A+Xi+azcBRL5JTk1+T4KSBGHmDbD/ph0oXrkttrLo6mssbucx:cD6yddSJYUbdh9oTLXKubuHdpqKmY7
TLSH
T1E2536C013798CA66E2AE47B8BCF3550106B1D1772112DA1E7CC810DB6BAFFC656126FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4772-0-0x0000000000890000-0x00000000008A6000-memory.dmp

Download

memory/4772-1-0x00007FFCB273F000-0x00007FFCB2740000-memory.dmp

Download

memory/4772-2-0x00007FFCB25B0000-0x00007FFCB2F54000-memory.dmp

Download

memory/4772-3-0x00007FFCB25B0000-0x00007FFCB2F54000-memory.dmp

Download

memory/4772-7-0x00007FFCB25B0000-0x00007FFCB2F54000-memory.dmp

Download