Overview

overview

10

Static

static

10

4f6384ff92...60.exe

windows10-2004-x64

10

4f6384ff92...60.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 21:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4f6384ff92b9556d23eb0ad8abbc695f6e3c1cddbc4631ef4beb53b6d360b360.exe
  • Size 46KB
  • Sample260702-1ctptab17n
  • SHA256 4f6384ff92b9556d23eb0ad8abbc695f6e3c1cddbc4631ef4beb53b6d360b360
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
nullasyncratrat

Malware Config

Extracted

Family

  • asyncrat

Version

  • 0.5.6A

Botnet

  • null

C2

  • keukengemaal.nl:6606

  • keukengemaal.nl:7707

  • keukengemaal.nl:8808

  • keukengemaal.nl:8080

  • keukengemaal.nl:443

  • keukengemaal.nl:80

Mutex

  • cwxryxwiuxbppsntlui

Attributes
  • delay

    5

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f6384ff92b9556d23eb0ad8abbc695f6e3c1cddbc4631ef4beb53b6d360b360.exe
    "C:\Users\Admin\AppData\Local\Temp\4f6384ff92b9556d23eb0ad8abbc695f6e3c1cddbc4631ef4beb53b6d360b360.exe"
    1⤵
      PID:1128
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
        PID:5280
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
            PID:1196
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
            PID:2056
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:4744

            Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 603B
                  • SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 599B
                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/1128-6-0x00007FFCD9450000-0x00007FFCD9DF4000-memory.dmp
                  Download

                  memory/1128-3-0x00007FFCD9450000-0x00007FFCD9DF4000-memory.dmp
                  Download

                  memory/1128-4-0x00007FFCD9450000-0x00007FFCD9DF4000-memory.dmp
                  Download

                  memory/1128-5-0x00007FFCD9450000-0x00007FFCD9DF4000-memory.dmp
                  Download

                  memory/1128-1-0x00007FFCD95DF000-0x00007FFCD95E0000-memory.dmp
                  Download

                  memory/1128-2-0x00007FFCD9450000-0x00007FFCD9DF4000-memory.dmp
                  Download

                  memory/1128-0-0x0000000000590000-0x00000000005A2000-memory.dmp
                  Download

                  memory/2056-22-0x000001E2001E0000-0x000001E2002E0000-memory.dmp
                  Download

                  memory/2056-33-0x000001E203930000-0x000001E203950000-memory.dmp
                  Download

                  memory/2056-44-0x000001E203D70000-0x000001E203D90000-memory.dmp
                  Download

                  memory/2056-71-0x000001E204250000-0x000001E204270000-memory.dmp
                  Download

                  memory/2056-34-0x000001E203E50000-0x000001E203F50000-memory.dmp
                  Download