asyncrat | 155d1dce8e17b107b531b80b648f1a3fcbcbed764d76a39b0b3972d9424dd2f7

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ven9392.exe
Size 3.3MB
Sample260714-pllvsaez9x
SHA256 155d1dce8e17b107b531b80b648f1a3fcbcbed764d76a39b0b3972d9424dd2f7
MD5 0268fde13e99c555ed4a4c6ef193b9ea
SHA1 ff5db489782f10217946f75450803f6c835108c5
SHA512 d6cefe8aa77a13d64eccbc121368d3f0cc36a954b91cb79d463c1634bef5b3d71ccf9d0e3675d51a3972797bcaf1047b92ee43fc04bf757e452edb2501cc6baa
SSDEEP 49152:4HSarve2wIDiFilNkzVMWzU0hdBdo+6WuDayPAr/NJJ8:4i29Dxb8h
TLSH
T162F54B41ABE8CE1BE1BF2775A4F200125BB1E449E732DB4B1694E6792C637406D0A37F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution asyncrat stormkitty persistence rat stealer

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000e00000001c505-11.dat	family_asyncrat

StormKitty payload 2 IoCs

resource	yara_rule
behavioral2/memory/5784-1-0x0000000000C30000-0x0000000000F7A000-memory.dmp	family_stormkitty
behavioral2/files/0x000e00000001c505-11.dat	family_stormkitty

Executes dropped EXE 2 IoCs

pid	Process
2996	Wihnup.exe
5596	Wihnup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4744	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe
5784	ven9392.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5784	ven9392.exe
Token: SeDebugPrivilege	5784	ven9392.exe
Token: SeDebugPrivilege	2996	Wihnup.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 5132	5784	ven9392.exe	89
PID 5784 wrote to memory of 6036	5784	ven9392.exe	91
PID 5132 wrote to memory of 4764	5132	cmd.exe	93
PID 6036 wrote to memory of 4744	6036	cmd.exe	94
PID 6036 wrote to memory of 5596	6036	cmd.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ven9392.exe
"C:\Users\Admin\AppData\Local\Temp\ven9392.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Wihnup" /tr '"C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Wihnup" /tr '"C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp479E.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4744
- - C:\Users\Admin\AppData\Local\Temp\Wihnup.exe
    "C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"
    3⤵
    - Executes dropped EXE
    PID:5596

C:\Users\Admin\AppData\Local\Temp\Wihnup.exe
"C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Wihnup.exe

Path C:\Users\Admin\AppData\Local\Temp\Wihnup.exe
Size 3.3MB
SHA256 155d1dce8e17b107b531b80b648f1a3fcbcbed764d76a39b0b3972d9424dd2f7
MD5 0268fde13e99c555ed4a4c6ef193b9ea
SHA1 ff5db489782f10217946f75450803f6c835108c5
SHA512 d6cefe8aa77a13d64eccbc121368d3f0cc36a954b91cb79d463c1634bef5b3d71ccf9d0e3675d51a3972797bcaf1047b92ee43fc04bf757e452edb2501cc6baa
SSDEEP 49152:4HSarve2wIDiFilNkzVMWzU0hdBdo+6WuDayPAr/NJJ8:4i29Dxb8h
TLSH
T162F54B41ABE8CE1BE1BF2775A4F200125BB1E449E732DB4B1694E6792C637406D0A37F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp479E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp479E.tmp.bat
Size 153B
SHA256 bc20a56d79dcadacb29517994985b2f24be1313f631e4bcd856d99fc71998d33
MD5 f06d8b6863f648f6b812dc4c3ffb449e
SHA1 a16f942e614545505660a723bc4651e16eb12aec
SHA512 32ac3ab3717fc717289841327998347057492b5d616e26f7c7af3abb7375bd776a1dfae2c1a62e44e458d35d409fbe4ad17043c9d0893d0327542c534861ff70
TLSH
T1FCC02B4295C7EA1F2808341305FADA8CD1B22C1E3F41FB70C344804D528044EF0D9341
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2996-14-0x0000000002A40000-0x0000000002A62000-memory.dmp

Download

memory/5784-0-0x00007FFB78BCF000-0x00007FFB78BD0000-memory.dmp

Download

memory/5784-1-0x0000000000C30000-0x0000000000F7A000-memory.dmp

Download

memory/5784-2-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp

Download

memory/5784-3-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp

Download

memory/5784-4-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp

Download

memory/5784-5-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp

Download

memory/5784-10-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp

Download