asyncrat | 08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
Size 45KB
Sample260801-xdyhlsvxev
SHA256 08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4
MD5 0af4eafdfafdbc9041ff173a6efdf6ae
SHA1 31070807af5c249458428b4895ea0c88af9b9f0e
SHA512 104803f3c91a9d3ebf15670362ce7296f4a2bdc2871c02a2e5415b48a175f7d964d9b1f21a8885b07684c85c440d0b036e17ddf7015c9448a8e809b82b452dc6
SSDEEP 768:4uBfJTMUyYUWUWBDimo2qV98V1RpYEcPIazjb1gX3iw6/SE7tsVM1w0rBDZbx:4uBfJTMpv2O8VDeEha3bSXSwJwqVMq0Z
TLSH
T11A233B0037E8C22BF2BE4F7899F26245867AF2672603D54A1CC451DB5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

heovl.im:80
heovl.im:22
heovl.im:8080
heovl.im:8880
heovl.im:2052
heovl.im:2082
heovl.im:2086
heovl.im:2095
heovl.im:443
heovl.im:2053
heovl.im:2083
heovl.im:2087
heovl.im:2096
heovl.im:8443
www.heovl.im:80
www.heovl.im:22
www.heovl.im:8080
www.heovl.im:8880
www.heovl.im:2052
www.heovl.im:2082
www.heovl.im:2086
www.heovl.im:2095
www.heovl.im:443
www.heovl.im:2053
www.heovl.im:2083
www.heovl.im:2087
www.heovl.im:2096
www.heovl.im:8443
industroyer.heovl.im:80
industroyer.heovl.im:22
industroyer.heovl.im:8080
industroyer.heovl.im:8880
industroyer.heovl.im:2052
industroyer.heovl.im:2082
industroyer.heovl.im:2086
industroyer.heovl.im:2095
industroyer.heovl.im:443
industroyer.heovl.im:2053
industroyer.heovl.im:2083
industroyer.heovl.im:2087
industroyer.heovl.im:2096
industroyer.heovl.im:8443
stuxnet.heovl.im:80
stuxnet.heovl.im:22
stuxnet.heovl.im:8080
stuxnet.heovl.im:8880
stuxnet.heovl.im:2052
stuxnet.heovl.im:2082
stuxnet.heovl.im:2086
stuxnet.heovl.im:2095
stuxnet.heovl.im:443
stuxnet.heovl.im:2053
stuxnet.heovl.im:2083
stuxnet.heovl.im:2087
stuxnet.heovl.im:2096
stuxnet.heovl.im:8443

Mutex

GoV8S6eTwiLo

Attributes

delay
0
install
true
install_file
wybw.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001200000001c3a2-10.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
944	wybw.exe
6060	wybw.exe

Outbound SSH connection to public host 2 TTPs 3 IoCs

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

command_and_control

Protocol Tunneling

T1572

Network Service Discovery

T1046

description	flow	ioc
SSH destination	7	104.26.6.168:22
SSH destination	8	104.26.7.168:22
SSH destination	10	172.67.71.133:22

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5992	cmd.exe
2676	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wybw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wybw.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5492	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
Token: SeDebugPrivilege	944	wybw.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 5992	4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe	90
PID 4904 wrote to memory of 2676	4904	08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe	92
PID 2676 wrote to memory of 5492	2676	cmd.exe	94
PID 5992 wrote to memory of 4396	5992	cmd.exe	95
PID 2676 wrote to memory of 6060	2676	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe
"C:\Users\Admin\AppData\Local\Temp\08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "wybw" /tr '"C:\Users\Admin\AppData\Roaming\wybw.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "wybw" /tr '"C:\Users\Admin\AppData\Roaming\wybw.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5B26.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5492
- - C:\Users\Admin\AppData\Roaming\wybw.exe
    "C:\Users\Admin\AppData\Roaming\wybw.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6060

C:\Users\Admin\AppData\Roaming\wybw.exe
"C:\Users\Admin\AppData\Roaming\wybw.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Protocol Tunneling

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5B26.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp5B26.tmp.bat
Size 148B
SHA256 a9d5710a5cd91cc15b6b30532ebbd601fd71466c0bbd524d63337d8b13978eaf
MD5 8ffcb34e1919538d3e85f6f0b55e5b18
SHA1 1df4392226f65abd0c12a4093ee4be10b9c94163
SHA512 e7fd54fef50db4fa9559712112455e71b102ffdcfbe0177c2b38477cebf327fb6f71428a5e5974d20a44a8728e1222e795b3bb0eb79dd60ae353d34f1da75a02
TLSH
T1E9C02B4355C9EA8F7C09181302FADA8D9172BC1A3F80FB00D304400E728094CF0DD351
MD5 SHA1 SHA512 TLSH

Submit Download

wybw.exe

Path C:\Users\Admin\AppData\Roaming\wybw.exe
Size 45KB
SHA256 08b4013b00a88972f9528590207c0ddace83dcb76437499c2d31406698a831a4
MD5 0af4eafdfafdbc9041ff173a6efdf6ae
SHA1 31070807af5c249458428b4895ea0c88af9b9f0e
SHA512 104803f3c91a9d3ebf15670362ce7296f4a2bdc2871c02a2e5415b48a175f7d964d9b1f21a8885b07684c85c440d0b036e17ddf7015c9448a8e809b82b452dc6
SSDEEP 768:4uBfJTMUyYUWUWBDimo2qV98V1RpYEcPIazjb1gX3iw6/SE7tsVM1w0rBDZbx:4uBfJTMpv2O8VDeEha3bSXSwJwqVMq0Z
TLSH
T11A233B0037E8C22BF2BE4F7899F26245867AF2672603D54A1CC451DB5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-12-0x0000000074F70000-0x000000007572C000-memory.dmp

Download

memory/944-14-0x0000000074F70000-0x000000007572C000-memory.dmp

Download

memory/4904-0-0x0000000074F82000-0x0000000074F83000-memory.dmp

Download

memory/4904-1-0x0000000000780000-0x0000000000792000-memory.dmp

Download

memory/4904-2-0x0000000074F70000-0x000000007572C000-memory.dmp

Download

memory/4904-3-0x0000000005140000-0x00000000051DC000-memory.dmp

Download

memory/4904-9-0x0000000074F70000-0x000000007572C000-memory.dmp

Download