asyncrat | 69487a2b695db2505ff24dc478dc1532ab9ad02659b74febb2d653ff2e65ed39

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.exe
Size 46KB
Sample260627-mwt8ssh14y
SHA256 69487a2b695db2505ff24dc478dc1532ab9ad02659b74febb2d653ff2e65ed39
MD5 36e1bedd3a80fde61101f74afb29fd13
SHA1 40366b3ba00f32f086f65c9280530b9a188d9a48
SHA512 8435d4e91cc4cbe1cd5f4da5c93b8571e6fac73690e6645002396bae012341771320c4975b1a869de98061678d56788421530a7116615dcb5996772beb6be9b3
SSDEEP 768:hqNVHbXQUapykOicvHk3eHlWMPbPgF0qo+MbprEgsvWGGKTYI6OC0NP6aNtYcFme:h1pyXvZH0ub4FrkbeWGGK96O3P6almVY
TLSH
T11B232B003BE98126E2FE5FB89DF5514587BAE6633603D65E3CC841DA07137C6CA42AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

null defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

14u.ru.com:6606
14u.ru.com:7707
14u.ru.com:8808
14u.ru.com:443
14u.ru.com:22
14u.ru.com:80

Mutex

bhbxmarwzixddecyy

Attributes

delay
5
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	1.exe

Executes dropped EXE 1 IoCs

pid	Process
4388	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4464	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4484	1.exe
4388	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	1.exe
Token: SeDebugPrivilege	4388	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3168	4484	1.exe	94
PID 4484 wrote to memory of 972	4484	1.exe	97
PID 972 wrote to memory of 4464	972	cmd.exe	99
PID 972 wrote to memory of 4388	972	cmd.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'svchost"' /tr "'C:\Users\Admin\AppData\Roaming\svchost.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB997.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4464
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpB997.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpB997.tmp.bat
Size 151B
SHA256 654690b00921426cf24ab20a28d5bbf89c3c1a0242759b70991575cc32289e2c
MD5 5d2a286f52a5cf8a82b35ef3d267bc01
SHA1 0d97aa89396771b32f2d88bf30aa31652e7a7dea
SHA512 9135200a9433221bc1b7d5acddd5ca124fdf7c6b4cf3de06b0a57e706fdb80bd00287ff4b8daf41b3ec866c8e24961103db7c3feba1dd4a7eedb4b5ed6687086
TLSH
T154C02B4391C5EA0F280514531AFAE48D92B26C1D3F40BF80C704401D23844CCF4EA341
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 44.2MB
SHA256 f1019eabd224fbbd7e343b2cb50d7805a73fb597ae0c5376358ad61aea7b0d16
MD5 828e3de5327828fae388907c804a1f2c
SHA1 b2a2e3129514cc3d02f52d485aaa975af2d8e51b
SHA512 e9bd31e38698c62f0f63837e566087941ab26e5cb39e51c14f6812822072ca874520dfceac16f16dd0e86852f93e59be3843524892cc4e430482d7e1c3da9b3d
SSDEEP 786432:TcTVRmiNEup7wr8m1RNrg0bwy+zUpUYLLzE4v3EFhi/VtxWup3:g2iHANe5J4pUyLzJ6E/vUup3
TLSH
T10EA733F7232D788AC15510316F96A49C13EEA3E7633CEDAE6DF966D9384632238440DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4484-0-0x0000000000100000-0x0000000000112000-memory.dmp

Download

memory/4484-1-0x000000001AE00000-0x000000001AE10000-memory.dmp

Download

memory/4484-2-0x000000001AE00000-0x000000001AE10000-memory.dmp

Download