asyncrat | c65f05b9f92b5d1cc2d19cf9f8d12fad263403d54952be88f93cd65a54239a5b

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IntimationRefund2024-2025.vbs
Size 4.3MB
Sample260730-y1372sfa34
SHA256 c65f05b9f92b5d1cc2d19cf9f8d12fad263403d54952be88f93cd65a54239a5b
MD5 3c65ccef988e27a2efc27cb11f31eafc
SHA1 9e95e95127a0ddd1257976eda1dfb1582f9fd952
SHA512 ffdb664bb644a568b694ba174da9cd6aa0167763f2a92d273a40194f031cafff01939e03a77c52d79d938fe9bc3ee7b53e53a5f95dddf9772093b30ebd2478e1
SSDEEP 24576:KrSVzHwm9MNo2bsO4sKps6CT28TSo3pLCym7hpxZU9xfARdKVKm32XsEdfQAxDKM:mB+
TLSH
T107269F606E5859F5EF8C6A0E90AE6F1D87F042176A33706BFB41DF04BD9A341864B21F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rediff defense_evasion discovery execution asyncrat donutloader loader persistence rat suricata

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

REDIFF

pradeepprabhu7055.duckdns.org:6606
46.151.182.205:6606

Mutex

AsyncMutex_alosh

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs

Network activity triggered a Suricata alert

suricata asyncrat

flow	pid	Process
8	1832	msra.exe
8	1832	msra.exe

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1468-36-0x0000000005410000-0x0000000005426000-memory.dmp	family_asyncrat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/1832-34-0x00000000006B0000-0x00000000006C8000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4084	powershell.exe
4696	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5088	vijewyufveonabghulluonouceyasi.exe
2992	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\ottgfe = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	reg.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1160	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5600	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5784	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4696	powershell.exe
4696	powershell.exe
4084	powershell.exe
4084	powershell.exe
1832	msra.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeDebugPrivilege	1832	msra.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1832	msra.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 4696	1160	WScript.exe	89
PID 1160 wrote to memory of 5600	1160	WScript.exe	91
PID 5600 wrote to memory of 4084	5600	cmd.exe	93
PID 4084 wrote to memory of 5784	4084	powershell.exe	95
PID 4084 wrote to memory of 2992	4084	powershell.exe	98
PID 2992 wrote to memory of 1468	2992	vijewyufveonabghulluonouceyasi.exe	99
PID 5088 wrote to memory of 1832	5088	vijewyufveonabghulluonouceyasi.exe	100
PID 5088 wrote to memory of 1832	5088	vijewyufveonabghulluonouceyasi.exe	100
PID 2992 wrote to memory of 1468	2992	vijewyufveonabghulluonouceyasi.exe	99
PID 1468 wrote to memory of 1296	1468	msra.exe	101
PID 1832 wrote to memory of 1736	1832	msra.exe	102

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IntimationRefund2024-2025.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$b64=[IO.File]::ReadAllText('C:\Temp\yellow.b64');$raw=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b64));[IO.File]::WriteAllBytes('C:\Temp\yellow.bat',[Convert]::FromBase64String($raw));Remove-Item 'C:\Temp\yellow.b64'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Temp\yellow.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w hidden -exec bypass -F "C:\Temp\update.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ottgfe /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe\" \"C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:5784
  - - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
      "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Windows\SysWOW64\msra.exe
        
        C:\Windows\Syswow64\msra.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1468
      - C:\Windows\system32\msra.exe
        
        "C:\Windows\system32\msra.exe"
        6⤵
        
        PID:1296

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\msra.exe
  C:\Windows\Syswow64\msra.exe
  2⤵
  - Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\system32\msra.exe
    "C:\Windows\system32\msra.exe"
    3⤵
    PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yellow.b64

Path C:\Temp\yellow.b64
Size 8.7MB
SHA256 2af560607f1e33a68d6ad95f3d9e761001f6ef8fb6940b2af1412ffd8e97a3ff
MD5 fb4567401387751d75aa0188203ca780
SHA1 8954fa52df4d214a1eae0e0b93916aa2529d3351
SHA512 2071a207f9121b2c1d5f9b7b0eddced36ed7deb0d02a0f9f729ece702aa5945917feadf12db72ffbce6964e83f6b3eb4678dec068024df9243828d072ce953da
SSDEEP 24576:kPRLX8BbVgGk5Dsi0Y7tp2UgNlwHV0KLFa4ii8arxgc0x6aUiHH3x6A8oV0cj7LZ:Z
TLSH
T11E964438B9BB51495837FF523EECB9EADCDE1B226945541B1041070BDA22AD0EF2387D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yellow.bat

Path C:\Temp\yellow.bat
Size 2.4MB
SHA256 9c3255dee30b25abe195c5ff9710c10b87fc03fa27186c475039466522713e6e
MD5 d009d61295342ee4955738e31130b61b
SHA1 65cf9b310b9fbfff70f9749a96ee1164c87ad47b
SHA512 9492e1bc2fe47c2ffc3434dd958f39462423eb382ae9707e56f2b5e81472b1975e419f7cf54ca3458919444cb08981cb95f6fc0103d79503d950bfe5f95a1566
SSDEEP 24576:nwsz5DgUdIYnqCrmEVWdn2jxZzebX9IhhDFfi/YuZcerQcTLVFg7pzUddE8WlXVq:/ZrEdnxMh7/ZM
TLSH
T1F3C59E0B4CE62A3DA7D8320D50BEE64F1E9015B7AECC146FDA2529697DB794DC00F0E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 92KB
SHA256 f968034784a3d6bb77e99e3e091ba6f4592d1f3aceb1c64f6341a4b8e188f608
MD5 f752cac9730afec5d8929a5acd7f6a37
SHA1 194eead82f9ba179546236f119eaafa979d5cd9a
SHA512 b3b6797cdfd6c0841c73272b9cf5c12d800240411d4f5d1d44152ce1469122eba6f202d9a716b46f844ebf5c76975727a1c7c794cb571ec20cb2146e5e4b7dd2
SSDEEP 1536:YmgGNFGGEVGujnB+TV223ILiq6ro8zsxhQA6tqQC30DFZFRGvu9UhEi+Li76MCfN:YmTjGhYujn822Qi188AxhQAiC30DTUhy
TLSH
T16493F180852A1CBE27B0DC5BC6531C7709784B298A34CDA58EE3C924E77FDA7735660C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 3KB
SHA256 a1cb6543780b03e71383d79ddaab5a3c5af20624e0b9fa12c09ae08afb1fa691
MD5 c9c94c7d0d4476c15fef8157690eb205
SHA1 6724dd685ec0f08e78522ce4b52ea65c505aa442
SHA512 62fccf59725a50827729359d483fbdc9c8cb421ab4830f598b6b57d7478e41aa17bbb37fd36ffd03323a68aeba044625bb260c19f8f0312dbe9439ae479dd709
TLSH
T10B51E0C47C0FE5402CA8211A9D29CE6BF79EADAF053D01307E99C2959FAC7BCE048748
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1468-36-0x0000000005410000-0x0000000005426000-memory.dmp

Download

memory/1832-34-0x00000000006B0000-0x00000000006C8000-memory.dmp

Download

memory/1832-42-0x00000000053F0000-0x0000000005456000-memory.dmp

Download

memory/1832-41-0x00000000065E0000-0x000000000667C000-memory.dmp

Download

memory/1832-40-0x0000000005230000-0x000000000523A000-memory.dmp

Download

memory/1832-39-0x0000000005250000-0x00000000052E2000-memory.dmp

Download

memory/1832-38-0x0000000005620000-0x0000000005BDA000-memory.dmp

Download

memory/4696-7-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4696-4-0x0000021DB9C80000-0x0000021DB9CA2000-memory.dmp

Download

memory/4696-1-0x00007FFC3A19F000-0x00007FFC3A1A0000-memory.dmp

Download

memory/4696-5-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4696-26-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4696-11-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4696-9-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4696-12-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download