asyncrat | 9e4cdfe0b7d2faea89b6d6ac6ef15273241865d5d36366aec5649d314ab07ecb

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stusb.exe
Size 48KB
Sample260703-lrcbrabw6n
SHA256 9e4cdfe0b7d2faea89b6d6ac6ef15273241865d5d36366aec5649d314ab07ecb
MD5 29ebbe013cabf5b36a5de7f1c38bcfcc
SHA1 ba2a10085678ea4db980bfa7de00bc3e82196630
SHA512 7fc75cea2c17effbb96464af774590c5a8d2c08d91581f9fa7d3f0e7b6e83ec536064ea9a26a41508075db052ea1c00aa69c88e4dad071dca2cf660251986dc8
SSDEEP 768:ZaT5yLHAu4xv8w8GYx8EiJOgmh3su31PyEgUYm0bXSO903yrcS4GFimM5bTf+:ZaT5y8VXMh35Jy8wbXSO9JrcS44DM5bi
TLSH
T12A233C007FE98126F6BD4FB8A9F2324582BAF5537603D54E1C8811DA5A13FC1DA426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

almasyhurtravel.com:6606
almasyhurtravel.com:7707
almasyhurtravel.com:8808
www.almasyhurtravel.com:6606
www.almasyhurtravel.com:7707
www.almasyhurtravel.com:8808
malware.almasyhurtravel.com:6606
malware.almasyhurtravel.com:7707
malware.almasyhurtravel.com:8808

Mutex

iVZ20iX0iYdf

Attributes

delay
3
install
true
install_file
Stusáb.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stusb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
888	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe
6100	Stusb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6100	Stusb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6100 wrote to memory of 2072	6100	Stusb.exe	88
PID 6100 wrote to memory of 3444	6100	Stusb.exe	90
PID 2072 wrote to memory of 1576	2072	cmd.exe	92
PID 3444 wrote to memory of 888	3444	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\Stusb.exe
"C:\Users\Admin\AppData\Local\Temp\Stusb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Stusáb" /tr '"C:\Users\Admin\AppData\Roaming\Stusáb.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Stusáb" /tr '"C:\Users\Admin\AppData\Roaming\Stusáb.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEC9D.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpEC9D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpEC9D.tmp.bat
Size 151B
SHA256 000862ec48858c5f48e83ef3ee7a96668576b029c4266d24c2a6d6a4088c7146
MD5 d00a755ac99b3c347ca37b82e86396d2
SHA1 4192d9ad5a34e899859a9dfd68c5e5885aad0d87
SHA512 7b44ce332c61c4ba2e85195f585fdc0edb29ca938c2846b8b0cbc25ab6694e9a2b1279734802c888f08be02e559ae580d73a00ceeb5d6587d9e841f5f54ed66e
TLSH
T189C02B5275C6EA8E3A05581306FED48CD1736C1D3F44BF20C30C450E13C0448F0EA341
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6100-0-0x0000000074882000-0x0000000074883000-memory.dmp

Download

memory/6100-1-0x0000000000720000-0x0000000000732000-memory.dmp

Download

memory/6100-2-0x0000000074870000-0x000000007502C000-memory.dmp

Download

memory/6100-3-0x0000000005250000-0x00000000052EC000-memory.dmp

Download

memory/6100-8-0x0000000074870000-0x000000007502C000-memory.dmp

Download