asyncrat | f29308df5ee60e232c4d8fec88ab82b87d01b7576bcd88a852f71752fc8819de

Analysis

max time kernel
148s
max time network
86s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hay88.exe
Size 45KB
Sample260711-mszdcaat6x
SHA256 f29308df5ee60e232c4d8fec88ab82b87d01b7576bcd88a852f71752fc8819de
MD5 6f0f06cb08831c4e995ee531e3670387
SHA1 ebd71f596e0b50f00474cb18563d3d71a04eacdc
SHA512 80c756e653366f9a177d14b6b18c6ddcced6256d18e2c0451e2ff91cf7d5bb795e75a7a49835824c51a8ec1eab26c09ee7e295a71679ad49104eed00cba3de8a
SSDEEP 768:NuGE1THwoPNWUtHT1MHmo2qzqfBohEa+PIvljbKgX3iT47v5gSCPWZBDZjx:NuGE1THbF1m2t4EaHvtbdXSUAodjx
TLSH
T138232B003BE8C26BF2BE4F789DF26145867AF2632603D54D2CC451D75613FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

amanson.it.com/vi-vn/:80
amanson.it.com/vi-vn/:8080
amanson.it.com/vi-vn/:443
amanson.it.com/vi-vn/:8443
amanson.it.com/vi-vn/:3306
amanson.it.com/vi-vn/:20
amanson.it.com/vi-vn/:25

Mutex

dWWUO0pEsgj1

Attributes

delay
3
install
true
install_file
hay88.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000b00000001b87f-10.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2360	hay88.exe
1476	hay88.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hay88.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hay88.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hay88.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5896	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe
2764	hay88.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	hay88.exe
Token: SeDebugPrivilege	2360	hay88.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 1388	2764	hay88.exe	87
PID 2764 wrote to memory of 5844	2764	hay88.exe	89
PID 5844 wrote to memory of 5896	5844	cmd.exe	91
PID 1388 wrote to memory of 4732	1388	cmd.exe	92
PID 5844 wrote to memory of 1476	5844	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\hay88.exe
"C:\Users\Admin\AppData\Local\Temp\hay88.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "hay88" /tr '"C:\Users\Admin\AppData\Roaming\hay88.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "hay88" /tr '"C:\Users\Admin\AppData\Roaming\hay88.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5421.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5896
- - C:\Users\Admin\AppData\Roaming\hay88.exe
    "C:\Users\Admin\AppData\Roaming\hay88.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1476

C:\Users\Admin\AppData\Roaming\hay88.exe
"C:\Users\Admin\AppData\Roaming\hay88.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5421.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp5421.tmp.bat
Size 149B
SHA256 932e392d88bf8dbfcb7d8a00570704eb7ccaa490d20da9c5aa4f38b13fb0a138
MD5 b002f280a51cd2c6592c1f0613ea76a5
SHA1 7685aa7805ced6a8026deb3ce908397fff6a0384
SHA512 bfb437be844fbfb169c1c1c1819da2033587a601548a663861df41e336ae620b5963683ddc6a5719fbae3e09d7bdf1967662b69bc3bcd3a0ac7ced7f4df0eeae
TLSH
T1B2C02B4365C9FE0F2805245302FBD98D91726C2A3F40FB40C30B4C0F5680448F0E9386
MD5 SHA1 SHA512 TLSH

Submit Download

hay88.exe

Path C:\Users\Admin\AppData\Roaming\hay88.exe
Size 45KB
SHA256 f29308df5ee60e232c4d8fec88ab82b87d01b7576bcd88a852f71752fc8819de
MD5 6f0f06cb08831c4e995ee531e3670387
SHA1 ebd71f596e0b50f00474cb18563d3d71a04eacdc
SHA512 80c756e653366f9a177d14b6b18c6ddcced6256d18e2c0451e2ff91cf7d5bb795e75a7a49835824c51a8ec1eab26c09ee7e295a71679ad49104eed00cba3de8a
SSDEEP 768:NuGE1THwoPNWUtHT1MHmo2qzqfBohEa+PIvljbKgX3iT47v5gSCPWZBDZjx:NuGE1THbF1m2t4EaHvtbdXSUAodjx
TLSH
T138232B003BE8C26BF2BE4F789DF26145867AF2632603D54D2CC451D75613FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2360-12-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/2360-14-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/2764-0-0x00000000749F2000-0x00000000749F3000-memory.dmp

Download

memory/2764-1-0x0000000000C10000-0x0000000000C22000-memory.dmp

Download

memory/2764-2-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/2764-3-0x0000000005730000-0x00000000057CC000-memory.dmp

Download

memory/2764-9-0x00000000749E0000-0x000000007519C000-memory.dmp

Download