asyncrat | 39fb915988fd11d8a1cfc6b398b1b14b3d9bbaf338739ba98f0b6ceb778f7735

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AsyncClient.exe
Size 79KB
Sample260628-phbweahs9j
SHA256 39fb915988fd11d8a1cfc6b398b1b14b3d9bbaf338739ba98f0b6ceb778f7735
MD5 63c17028ad2aceb51aa398c5b4877992
SHA1 c852fe2e43522d56c2de584b431b12acb9b1e806
SHA512 eca5c077ce186c12a7883a0a9c9968948050db8e48804587c5ce607012b1788d1d08ac570a7563c75e2ebd95e8d915858e163baddb3d82a80782037ff2ce03f7
SSDEEP 1536:ousy1TQqV2FKTkDy3bCXS6ddFwevI9w/:ousGTQqV2FskDy3bCxTeJw/
TLSH
T191836C003FE8C12BE27E5F795DF29645467BF6572A02C54A2DC05A8F0A23FC699026ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

https://soken.jp.net/:6606
https://soken.jp.net/:7707
https://soken.jp.net/:8808
https://soken.jp.net/:80
https://soken.jp.net/:443

Mutex

QYFeuxHHNwvp

Attributes

delay
10
install
true
install_file
Soken.jp.net/.exe
install_folder
%AppData%
local_host
127.0.0.1

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	AsyncClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe
2692	AsyncClient.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	AsyncClient.exe
Token: SeDebugPrivilege	2692	AsyncClient.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 1440	2692	AsyncClient.exe	86
PID 1440 wrote to memory of 3616	1440	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "" /tr '"C:\Users\Admin\AppData\Roaming\Soken.jp.net\.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "" /tr '"C:\Users\Admin\AppData\Roaming\Soken.jp.net\.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3616