asyncrat | 9eafb48dc15a54b008e16240a623dcc98ee01203a1afc0cbdcd14ef3b7bc7b9d

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xl.exe
Size 45KB
Sample260626-tp164adt7m
SHA256 9eafb48dc15a54b008e16240a623dcc98ee01203a1afc0cbdcd14ef3b7bc7b9d
MD5 2bd6ed9fb87190f0d6cea199eb064fdf
SHA1 e24693d0f20001af18409ab5bedf97db70bed081
SHA512 83fbff1a9d05eefdb40784a505d6be73cc2693ddeab671cb0ad767ba0e180de77b5210a6ac79ef9a241ff98bcb8de258eb5d7c73d3ab0ea243c3699cd4f7c18f
SSDEEP 768:Ju0uVTBRlc6nWUbjelmo2qjaR04mmVtbbba7m/RPIWzjbggn3i75dcwpuJeXPXNL:Ju0uVTBncr2vRJ/q70OW3bHnSldcwpu0
TLSH
T120231B003BE8812AF2BF4FB899F26245867AF1732603D65A1CC451DB5713BC59A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

agrione.io:443
agrione.io:80
agrione.io:25
agrione.io:8443
xoilac6686.com:443
xoilac6686.com:80
xoilac6686.com:25
xoilac6686.com:8443
tecnifutbol.org:443
tecnifutbol.org:80
tecnifutbol.org:25
tecnifutbol.org:8443
okulo.io:443
okulo.io:80
okulo.io:25
okulo.io:8443

Mutex

BiJuDMTP1KfO

Attributes

delay
9
install
true
install_file
xl.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001600000001c3f1-11.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
5424	xl.exe
3888	xl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xl.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6020	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe
3528	xl.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3528	xl.exe
Token: SeDebugPrivilege	5424	xl.exe
Token: SeDebugPrivilege	5424	xl.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 3452	3528	xl.exe	90
PID 3528 wrote to memory of 2632	3528	xl.exe	92
PID 3452 wrote to memory of 2268	3452	cmd.exe	94
PID 2632 wrote to memory of 6020	2632	cmd.exe	95
PID 2632 wrote to memory of 3888	2632	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\xl.exe
"C:\Users\Admin\AppData\Local\Temp\xl.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "xl" /tr '"C:\Users\Admin\AppData\Roaming\xl.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "xl" /tr '"C:\Users\Admin\AppData\Roaming\xl.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF112.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:6020
- - C:\Users\Admin\AppData\Roaming\xl.exe
    "C:\Users\Admin\AppData\Roaming\xl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3888

C:\Users\Admin\AppData\Roaming\xl.exe
"C:\Users\Admin\AppData\Roaming\xl.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpF112.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpF112.tmp.bat
Size 146B
SHA256 8d3aa3dec957916c7fd0c3695899e05d4cd85b0a253453481ee51474dd58fa82
MD5 b27a6c48279c843b5e15b7526a5b7e1e
SHA1 d987ffae122312fe98b3929901c36e9fe903ee96
SHA512 2329c3e5c6039e940e84fac1e7cb5e7d9f87221b7b39eaf454fdf990d4e55a26cb73d95bc8f7b3abcc59394c522d1c4e01b1bf147b4bbdc2905685089ed7aca3
TLSH
T10DC02B9359C5FB2E6C0564131AFBE49D917B6C593F40BF00C304440D12C0848F0D9341
MD5 SHA1 SHA512 TLSH

Submit Download

xl.exe

Path C:\Users\Admin\AppData\Roaming\xl.exe
Size 45KB
SHA256 9eafb48dc15a54b008e16240a623dcc98ee01203a1afc0cbdcd14ef3b7bc7b9d
MD5 2bd6ed9fb87190f0d6cea199eb064fdf
SHA1 e24693d0f20001af18409ab5bedf97db70bed081
SHA512 83fbff1a9d05eefdb40784a505d6be73cc2693ddeab671cb0ad767ba0e180de77b5210a6ac79ef9a241ff98bcb8de258eb5d7c73d3ab0ea243c3699cd4f7c18f
SSDEEP 768:Ju0uVTBRlc6nWUbjelmo2qjaR04mmVtbbba7m/RPIWzjbggn3i75dcwpuJeXPXNL:Ju0uVTBncr2vRJ/q70OW3bHnSldcwpu0
TLSH
T120231B003BE8812AF2BF4FB899F26245867AF1732603D65A1CC451DB5713BC59A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3528-0-0x0000000074C52000-0x0000000074C53000-memory.dmp

Download

memory/3528-1-0x0000000000910000-0x0000000000922000-memory.dmp

Download

memory/3528-2-0x0000000074C52000-0x0000000074C53000-memory.dmp

Download

memory/3528-3-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/3528-4-0x0000000005490000-0x000000000552C000-memory.dmp

Download

memory/3528-9-0x0000000074C40000-0x00000000753FC000-memory.dmp

Download

memory/5424-13-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download

memory/5424-15-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download