asyncrat | 69487a2b695db2505ff24dc478dc1532ab9ad02659b74febb2d653ff2e65ed39

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.exe
Size 46KB
Sample260627-mwt8ssh14y
SHA256 69487a2b695db2505ff24dc478dc1532ab9ad02659b74febb2d653ff2e65ed39
MD5 36e1bedd3a80fde61101f74afb29fd13
SHA1 40366b3ba00f32f086f65c9280530b9a188d9a48
SHA512 8435d4e91cc4cbe1cd5f4da5c93b8571e6fac73690e6645002396bae012341771320c4975b1a869de98061678d56788421530a7116615dcb5996772beb6be9b3
SSDEEP 768:hqNVHbXQUapykOicvHk3eHlWMPbPgF0qo+MbprEgsvWGGKTYI6OC0NP6aNtYcFme:h1pyXvZH0ub4FrkbeWGGK96O3P6almVY
TLSH
T11B232B003BE98126E2FE5FB89DF5514587BAE6633603D65E3CC841DA07137C6CA42AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

null defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

14u.ru.com:6606
14u.ru.com:7707
14u.ru.com:8808
14u.ru.com:443
14u.ru.com:22
14u.ru.com:80

Mutex

bhbxmarwzixddecyy

Attributes

delay
5
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Executes dropped EXE 2 IoCs

pid	Process
3488	svchost.exe
7164	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2592	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
6324	1.exe
3488	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6324	1.exe
Token: SeDebugPrivilege	3488	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6324 wrote to memory of 5840	6324	1.exe	90
PID 6324 wrote to memory of 5820	6324	1.exe	92
PID 5820 wrote to memory of 2592	5820	cmd.exe	95
PID 5820 wrote to memory of 7164	5820	cmd.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6324
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'svchost"' /tr "'C:\Users\Admin\AppData\Roaming\svchost.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAB10.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2592
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:7164

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpAB10.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpAB10.tmp.bat
Size 151B
SHA256 a4e4457410a26bb7d7f3606cea940e55aebd58243c29dc69c212f7dbed134ee2
MD5 20e2568907ad1db45af263628cb31780
SHA1 05b0e0c7ddbc30c2f8afe8f0b03005ccf4dfcd10
SHA512 aabfef9f1d6905c4b9c99da48c6cec08222e73a9678088090f74a2669556c2af4993760b1c574873ce39517a318ee3584c49ad7578edadc899cfd5dbd41407a2
TLSH
T1A5C02B5251C5EA4E2C09145302FAD4DF92B26C593F40BF80C304411D23C045CF4EA341
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 40.9MB
SHA256 43d75104bc71276e08cad17e3e55145df8f18957dd3ed44689d2e8b3486a4624
MD5 052089c5f4687a71a804c2863165f465
SHA1 8816625cd17fbcfeefec0f639e303767d29e3c12
SHA512 8f01b90dffc6679b2c399c351e4dc6451a1352cdd1a27ac68a9c713b457debfbd253a276395e83a43cd4e5e2f54de108522ba15c5ce5239634ecf63f099ed524
SSDEEP 786432:yiGoQzrylPCuqfTOC64c93P20Ppz74zOvXoJjhYsZTOF0GwYkcTgid2Q:y/oQvKxA5Pcp20PF7Ic0hYslOKDBQ2Q
TLSH
T1A89733104D3A91A6F593BBE8A4F500CE903FF197A2CB141B7E79368D56609CB6E6F1C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3488-12-0x00007FF8168E0000-0x00007FF817284000-memory.dmp

Download

memory/3488-13-0x00007FF8168E0000-0x00007FF817284000-memory.dmp

Download

memory/3488-14-0x00007FF8168E0000-0x00007FF817284000-memory.dmp

Download

memory/3488-16-0x00007FF8168E0000-0x00007FF817284000-memory.dmp

Download

memory/6324-1-0x0000000000CD0000-0x0000000000CE2000-memory.dmp

Download

memory/6324-0-0x00007FF816A6F000-0x00007FF816A70000-memory.dmp

Download

memory/6324-2-0x00007FF8168E0000-0x00007FF817284000-memory.dmp

Download

memory/6324-3-0x00007FF8168E0000-0x00007FF817284000-memory.dmp

Download

memory/6324-4-0x00007FF8168E0000-0x00007FF817284000-memory.dmp

Download

memory/6324-8-0x00007FF8168E0000-0x00007FF817284000-memory.dmp

Download