asyncrat | a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de

Analysis

max time kernel
6s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
Size 45KB
Sample260710-t33bbacz3k
SHA256 a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de
MD5 443cbcea0a1b685c22bf97712107f556
SHA1 26cb4673e71d599e1617f3ecab9bfe40ffaf9892
SHA512 e531476ddf37c3c75e2ede4c8733e8726455c8979f83c7af8f0eaa1c5bd04b24f47cc9a5e8915cd74dc2272b392da2bba6f9d629aa0c1434deb48479c2d08baf
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1/BzCQKx7PImwjbNgX3ibYl9vw1PKfyQwBDZUx:cu6YepTPso2+o0m4baXSMIyZmdUx
TLSH
T135231A003BE88227F2BE4F78ACF26145867AF5633603D54D6CC451DB5623BC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexinfrankfurt.com:80
sexinfrankfurt.com:22
sexinfrankfurt.com:8080
sexinfrankfurt.com:8880
sexinfrankfurt.com:2052
sexinfrankfurt.com:2082
sexinfrankfurt.com:2086
sexinfrankfurt.com:2095
sexinfrankfurt.com:443
sexinfrankfurt.com:2053
sexinfrankfurt.com:2083
sexinfrankfurt.com:2087
sexinfrankfurt.com:2096
sexinfrankfurt.com:8443
www.sexinfrankfurt.com:80
www.sexinfrankfurt.com:22
www.sexinfrankfurt.com:8080
www.sexinfrankfurt.com:8880
www.sexinfrankfurt.com:2052
www.sexinfrankfurt.com:2082
www.sexinfrankfurt.com:2086
www.sexinfrankfurt.com:2095
www.sexinfrankfurt.com:443
www.sexinfrankfurt.com:2053
www.sexinfrankfurt.com:2083
www.sexinfrankfurt.com:2087
www.sexinfrankfurt.com:2096
www.sexinfrankfurt.com:8443
blacklotus.sexinfrankfurt.com:80
blacklotus.sexinfrankfurt.com:22
blacklotus.sexinfrankfurt.com:8080
blacklotus.sexinfrankfurt.com:8880
blacklotus.sexinfrankfurt.com:2052
blacklotus.sexinfrankfurt.com:2082
blacklotus.sexinfrankfurt.com:2086
blacklotus.sexinfrankfurt.com:2095
blacklotus.sexinfrankfurt.com:443
blacklotus.sexinfrankfurt.com:2053
blacklotus.sexinfrankfurt.com:2083
blacklotus.sexinfrankfurt.com:2087
blacklotus.sexinfrankfurt.com:2096
blacklotus.sexinfrankfurt.com:8443
fakeupdates.sexinfrankfurt.com:80
fakeupdates.sexinfrankfurt.com:22
fakeupdates.sexinfrankfurt.com:8080
fakeupdates.sexinfrankfurt.com:8880
fakeupdates.sexinfrankfurt.com:2052
fakeupdates.sexinfrankfurt.com:2082
fakeupdates.sexinfrankfurt.com:2086
fakeupdates.sexinfrankfurt.com:2095
fakeupdates.sexinfrankfurt.com:443
fakeupdates.sexinfrankfurt.com:2053
fakeupdates.sexinfrankfurt.com:2083
fakeupdates.sexinfrankfurt.com:2087
fakeupdates.sexinfrankfurt.com:2096
fakeupdates.sexinfrankfurt.com:8443

Mutex

HfzSnZhSv2XN

Attributes

delay
0
install
true
install_file
c2tlydrc.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0005000000016b3f-10.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
4208	c2tlydrc.exe
240	c2tlydrc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2tlydrc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2tlydrc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3716	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1048	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 5576	2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe	88
PID 2020 wrote to memory of 5384	2020	a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe	90
PID 5576 wrote to memory of 1048	5576	cmd.exe	92
PID 5384 wrote to memory of 3716	5384	cmd.exe	93
PID 5384 wrote to memory of 240	5384	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe
"C:\Users\Admin\AppData\Local\Temp\a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "c2tlydrc" /tr '"C:\Users\Admin\AppData\Roaming\c2tlydrc.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "c2tlydrc" /tr '"C:\Users\Admin\AppData\Roaming\c2tlydrc.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8F27.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5384
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3716
- - C:\Users\Admin\AppData\Roaming\c2tlydrc.exe
    "C:\Users\Admin\AppData\Roaming\c2tlydrc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:240

C:\Users\Admin\AppData\Roaming\c2tlydrc.exe
"C:\Users\Admin\AppData\Roaming\c2tlydrc.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp8F27.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp8F27.tmp.bat
Size 152B
SHA256 319c9905fbddb54408dc9570420e926ec0666b8d482331bf5031ff876afc5103
MD5 2a4e0ab85acc0199cc2885d5ff7fc860
SHA1 eabe04ecca5ba1bd53b94f146df38f49a3911312
SHA512 ce6907a7a5ecf17718d1b443ef3c2bd213eac2e3b7fde9cfbea9544be20253c1f001e7e6c4ce1ff4c41836509be3c5f532d1c336781a8b7857bd052161bf9126
TLSH
T116C08C4252C7EA4F2C09542306FAD88C91B6EC193E82BB00874480096680848F0D9281
MD5 SHA1 SHA512 TLSH

Submit Download

c2tlydrc.exe

Path C:\Users\Admin\AppData\Roaming\c2tlydrc.exe
Size 45KB
SHA256 a759464b7931a071b84dc173ec5ea8b9bb1ca23957792f54d5219cbac4fb80de
MD5 443cbcea0a1b685c22bf97712107f556
SHA1 26cb4673e71d599e1617f3ecab9bfe40ffaf9892
SHA512 e531476ddf37c3c75e2ede4c8733e8726455c8979f83c7af8f0eaa1c5bd04b24f47cc9a5e8915cd74dc2272b392da2bba6f9d629aa0c1434deb48479c2d08baf
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1/BzCQKx7PImwjbNgX3ibYl9vw1PKfyQwBDZUx:cu6YepTPso2+o0m4baXSMIyZmdUx
TLSH
T135231A003BE88227F2BE4F78ACF26145867AF5633603D54D6CC451DB5623BC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2020-0-0x0000000074C82000-0x0000000074C83000-memory.dmp

Download

memory/2020-1-0x0000000000D20000-0x0000000000D32000-memory.dmp

Download

memory/2020-2-0x0000000074C70000-0x000000007542C000-memory.dmp

Download

memory/2020-3-0x0000000005840000-0x00000000058DC000-memory.dmp

Download

memory/2020-8-0x0000000074C70000-0x000000007542C000-memory.dmp

Download

memory/4208-12-0x0000000074A70000-0x000000007522C000-memory.dmp

Download

memory/4208-14-0x0000000074A70000-0x000000007522C000-memory.dmp

Download