asyncrat | 1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
Size 45KB
Sample260718-vbge7sbs8t
SHA256 1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53
MD5 571210dcf3bad5b2c4f968faff8b4e2c
SHA1 064bf8e013e92fa93df93ae3a063cecd64fd3efe
SHA512 3030e9477c1a3f6584707a7776de71e43a85f4f9b134f49d2cdd72a7e58fec191947c56c61019fa8d10ddec68db743b4472447052ce60ce16dedbf7e30e1ccb9
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwm9SKFWKoobbb4vhy/nPIAizjbSgX3ia33POyRISc8:ku40ZTXEb22SKdivh4AAi3bVXS2P9GS9
TLSH
T128231A103BE9812BF2BF4F78A9F26145867AF2237603D54A1CC451DB5713FC68A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimsexvn.mobi:80
phimsexvn.mobi:22
phimsexvn.mobi:8080
phimsexvn.mobi:8880
phimsexvn.mobi:2052
phimsexvn.mobi:2082
phimsexvn.mobi:2086
phimsexvn.mobi:2095
phimsexvn.mobi:443
phimsexvn.mobi:2053
phimsexvn.mobi:2083
phimsexvn.mobi:2087
phimsexvn.mobi:2096
phimsexvn.mobi:8443
www.phimsexvn.mobi:80
www.phimsexvn.mobi:22
www.phimsexvn.mobi:8080
www.phimsexvn.mobi:8880
www.phimsexvn.mobi:2052
www.phimsexvn.mobi:2082
www.phimsexvn.mobi:2086
www.phimsexvn.mobi:2095
www.phimsexvn.mobi:443
www.phimsexvn.mobi:2053
www.phimsexvn.mobi:2083
www.phimsexvn.mobi:2087
www.phimsexvn.mobi:2096
www.phimsexvn.mobi:8443
emotet.phimsexvn.mobi:80
emotet.phimsexvn.mobi:22
emotet.phimsexvn.mobi:8080
emotet.phimsexvn.mobi:8880
emotet.phimsexvn.mobi:2052
emotet.phimsexvn.mobi:2082
emotet.phimsexvn.mobi:2086
emotet.phimsexvn.mobi:2095
emotet.phimsexvn.mobi:443
emotet.phimsexvn.mobi:2053
emotet.phimsexvn.mobi:2083
emotet.phimsexvn.mobi:2087
emotet.phimsexvn.mobi:2096
emotet.phimsexvn.mobi:8443
malware.phimsexvn.mobi:80
malware.phimsexvn.mobi:22
malware.phimsexvn.mobi:8080
malware.phimsexvn.mobi:8880
malware.phimsexvn.mobi:2052
malware.phimsexvn.mobi:2082
malware.phimsexvn.mobi:2086
malware.phimsexvn.mobi:2095
malware.phimsexvn.mobi:443
malware.phimsexvn.mobi:2053
malware.phimsexvn.mobi:2083
malware.phimsexvn.mobi:2087
malware.phimsexvn.mobi:2096
malware.phimsexvn.mobi:8443
zbot.phimsexvn.mobi:80
zbot.phimsexvn.mobi:22
zbot.phimsexvn.mobi:8080
zbot.phimsexvn.mobi:8880
zbot.phimsexvn.mobi:2052
zbot.phimsexvn.mobi:2082
zbot.phimsexvn.mobi:2086
zbot.phimsexvn.mobi:2095
zbot.phimsexvn.mobi:443
zbot.phimsexvn.mobi:2053
zbot.phimsexvn.mobi:2083
zbot.phimsexvn.mobi:2087
zbot.phimsexvn.mobi:2096
zbot.phimsexvn.mobi:8443
lokibot.phimsexvn.mobi:80
lokibot.phimsexvn.mobi:22
lokibot.phimsexvn.mobi:8080
lokibot.phimsexvn.mobi:8880
lokibot.phimsexvn.mobi:2052
lokibot.phimsexvn.mobi:2082
lokibot.phimsexvn.mobi:2086
lokibot.phimsexvn.mobi:2095
lokibot.phimsexvn.mobi:443
lokibot.phimsexvn.mobi:2053
lokibot.phimsexvn.mobi:2083
lokibot.phimsexvn.mobi:2087
lokibot.phimsexvn.mobi:2096
lokibot.phimsexvn.mobi:8443

Mutex

tNW74nYnX6JU

Attributes

delay
0
install
true
install_file
o6wky.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x002200000001c58c-10.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
4656	o6wky.exe
1688	o6wky.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2784	cmd.exe
3532	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o6wky.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o6wky.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3544	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
Token: SeDebugPrivilege	4656	o6wky.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 2784	3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe	89
PID 3680 wrote to memory of 3532	3680	1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe	90
PID 3532 wrote to memory of 3544	3532	cmd.exe	93
PID 2784 wrote to memory of 4292	2784	cmd.exe	94
PID 3532 wrote to memory of 1688	3532	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe
"C:\Users\Admin\AppData\Local\Temp\1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "o6wky" /tr '"C:\Users\Admin\AppData\Roaming\o6wky.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "o6wky" /tr '"C:\Users\Admin\AppData\Roaming\o6wky.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp797C.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3544
- - C:\Users\Admin\AppData\Roaming\o6wky.exe
    "C:\Users\Admin\AppData\Roaming\o6wky.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1688

C:\Users\Admin\AppData\Roaming\o6wky.exe
"C:\Users\Admin\AppData\Roaming\o6wky.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp797C.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp797C.tmp.bat
Size 149B
SHA256 69e99682ce56c5edfa755ce0117465c89197a2bf6ab652d6bae6d433202c5583
MD5 3ddac3d3827db5b0b6f25ed22cb70093
SHA1 969f4b83c3812918f147a18bb2150cd25c53e964
SHA512 1498098e6e2e951d19ea7e1f07e68a46ead6426c89c29a7b9bbd079236e9a7a94c88bb46c7670e0d862652145b278850d4bd3c4947c35e2f421ef15ab6744c38
TLSH
T1EFC02B5296C5EA0E2D05641303FAD48CA1B26C2D3F80BB00CB44840E16C0848F4DE391
MD5 SHA1 SHA512 TLSH

Submit Download

o6wky.exe

Path C:\Users\Admin\AppData\Roaming\o6wky.exe
Size 45KB
SHA256 1a174786b8b06ea5d6eb7422c5de5748000e57621d73fe8d16d7e935539dcc53
MD5 571210dcf3bad5b2c4f968faff8b4e2c
SHA1 064bf8e013e92fa93df93ae3a063cecd64fd3efe
SHA512 3030e9477c1a3f6584707a7776de71e43a85f4f9b134f49d2cdd72a7e58fec191947c56c61019fa8d10ddec68db743b4472447052ce60ce16dedbf7e30e1ccb9
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwm9SKFWKoobbb4vhy/nPIAizjbSgX3ia33POyRISc8:ku40ZTXEb22SKdivh4AAi3bVXS2P9GS9
TLSH
T128231A103BE9812BF2BF4F78A9F26145867AF2237603D54A1CC451DB5713FC68A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3680-0-0x0000000074382000-0x0000000074383000-memory.dmp

Download

memory/3680-1-0x0000000000810000-0x0000000000822000-memory.dmp

Download

memory/3680-2-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/3680-3-0x0000000005370000-0x000000000540C000-memory.dmp

Download

memory/3680-8-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/4656-12-0x0000000074200000-0x00000000749BC000-memory.dmp

Download

memory/4656-14-0x0000000074200000-0x00000000749BC000-memory.dmp

Download