asyncrat | 030b9670c0024fd03679f2ff0c51f4eed38ddc730258f19a88297d9aa3a89e17

Analysis

max time kernel
28s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2.exe
Size 46KB
Sample260627-mxlytaaz2m
SHA256 030b9670c0024fd03679f2ff0c51f4eed38ddc730258f19a88297d9aa3a89e17
MD5 6bbe7da5172df8dfba9734f81dcb7aa4
SHA1 9a247fbb7a81b3400ab124d5aa631929d416a51f
SHA512 f4e4c8f678e339018a4c1b65425f9ba30afea2fbacef8a950113bf8014a4a95071419afc73e8f8436ba53818db114128e606b3babd06ff9a0116ba8458730b1d
SSDEEP 768:hqNVHbXQUapykOicvHk3eHlWMPbPgF0qqok27jVJVe1YI6OC0NP6aNtYcFmVc6K:h1pyXvZH0ub4Frqol7jVJs6O3P6almVY
TLSH
T11A232B003BE98126E1BE5FB8ADF1514187BAE6633603D65E3CC841DB17137C6CA52AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

null defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

vuabet88bet.com:6606
vuabet88bet.com:7707
vuabet88bet.com:8808
vuabet88bet.com:443
vuabet88bet.com:22
vuabet88bet.com:80

Mutex

bhbxmarwzixddecyy

Attributes

delay
5
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Executes dropped EXE 2 IoCs

pid	Process
4268	svchost.exe
6128	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3560	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
2932	2.exe
4268	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	2.exe
Token: SeDebugPrivilege	4268	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1408	2932	2.exe	89
PID 2932 wrote to memory of 2508	2932	2.exe	92
PID 2508 wrote to memory of 3560	2508	cmd.exe	94
PID 2508 wrote to memory of 6128	2508	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'svchost"' /tr "'C:\Users\Admin\AppData\Roaming\svchost.exe"'
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA9B8.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3560
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:6128

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2432
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:752

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3028

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

tmpA9B8.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpA9B8.tmp.bat
Size 151B
SHA256 f24ca629ada1e20d18d919e40b22e8a0bba27e469064b7e921b2bee672876ef6
MD5 d485abbab1c6349599cb1301ef4a3ff2
SHA1 cd42eac72f9dfb5e62cedd923ebee09a70a1b838
SHA512 c6518228668562c6e1ebe61e993e38ad3fbf2f6220efd430afa6a5f309dbd68bd63bbb4bc39c0a782f339a147be9b1448d4ccc16ee50dbd2e030b812a9c4dcff
TLSH
T11DC02B4292C5EA0E2905185302FAD48E93B36C5D3F40BFA0C704401D238085CF8EA345
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 44.2MB
SHA256 039cdfd46806ca723e7be1e070a8e77f8675b06b58874086aaa38d16374e368c
MD5 8b2a88760e87b6627a7bf36a322a82ec
SHA1 b9300b6a0db7098c989561207e105be70061a35b
SHA512 cc9b953206eb6cb78fd7f952225d990274afdead179eed8a6707786f29a17a2c3189db34cb6a444ce49a498919fb3dd6bfb2a0c4af356c95802c439eb939cbd5
SSDEEP 786432:pPmX8byZKnFx2U4mtEiegaSKrhlZzKWcP7/YPdFR0CPVm4j:pPS2F8UHEhrhXg/YeCNt
TLSH
T1F3A7337460C788E320DB47FAE6052BE6E559AE42120AD16E74DB371F308F346F5AC399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2932-1-0x0000000000C90000-0x0000000000CA2000-memory.dmp

Download

memory/2932-2-0x00007FFC3A780000-0x00007FFC3B124000-memory.dmp

Download

memory/2932-3-0x00007FFC3A780000-0x00007FFC3B124000-memory.dmp

Download

memory/2932-4-0x00007FFC3A780000-0x00007FFC3B124000-memory.dmp

Download

memory/2932-8-0x00007FFC3A780000-0x00007FFC3B124000-memory.dmp

Download

memory/2932-0-0x00007FFC3A90F000-0x00007FFC3A910000-memory.dmp

Download

memory/3028-67-0x000002A603C90000-0x000002A603CB0000-memory.dmp

Download

memory/3028-41-0x000002A6001E0000-0x000002A6002E0000-memory.dmp

Download

memory/3028-51-0x000002A603930000-0x000002A603950000-memory.dmp

Download

memory/3028-40-0x000002A6001E0000-0x000002A6002E0000-memory.dmp

Download

memory/3028-85-0x000002A614210000-0x000002A614230000-memory.dmp

Download

memory/3028-52-0x000002A613E90000-0x000002A613F90000-memory.dmp

Download

memory/4268-14-0x000000001E300000-0x000000001E3F0000-memory.dmp

Download

memory/4268-13-0x000000001E300000-0x000000001E3F0000-memory.dmp

Download