asyncrat | 6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
Size 45KB
Sample260804-hfcllaee84
SHA256 6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415
MD5 13e018ae1ae9464ca46fef0b5974764f
SHA1 3701685076fb63d79b8ed3748c7349d43831a044
SHA512 0de38464c7c5dfc212d47950c4a46c0e149bbfaf302a42e4eaf262cc175cb5a333146647f71085846abfc5d22359b9198b60aa222e969a9499f2999751114ff7
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9sZoyTM4PIXvjb+gX3iAPHxUkq5CDuqBDZ8x:0u1YJTHcw2dh0XbbBXSAPHCkq58ld8x
TLSH
T1D1231A0037E8822BF2BE5F78A9F26145867AF5673A03D58E1CC441DB5613FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsexvietnam.com:80
fimsexvietnam.com:22
fimsexvietnam.com:8080
fimsexvietnam.com:8880
fimsexvietnam.com:2052
fimsexvietnam.com:2082
fimsexvietnam.com:2086
fimsexvietnam.com:2095
fimsexvietnam.com:443
fimsexvietnam.com:2053
fimsexvietnam.com:2083
fimsexvietnam.com:2087
fimsexvietnam.com:2096
fimsexvietnam.com:8443
www.fimsexvietnam.com:80
www.fimsexvietnam.com:22
www.fimsexvietnam.com:8080
www.fimsexvietnam.com:8880
www.fimsexvietnam.com:2052
www.fimsexvietnam.com:2082
www.fimsexvietnam.com:2086
www.fimsexvietnam.com:2095
www.fimsexvietnam.com:443
www.fimsexvietnam.com:2053
www.fimsexvietnam.com:2083
www.fimsexvietnam.com:2087
www.fimsexvietnam.com:2096
www.fimsexvietnam.com:8443
client.fimsexvietnam.com:80
client.fimsexvietnam.com:22
client.fimsexvietnam.com:8080
client.fimsexvietnam.com:8880
client.fimsexvietnam.com:2052
client.fimsexvietnam.com:2082
client.fimsexvietnam.com:2086
client.fimsexvietnam.com:2095
client.fimsexvietnam.com:443
client.fimsexvietnam.com:2053
client.fimsexvietnam.com:2083
client.fimsexvietnam.com:2087
client.fimsexvietnam.com:2096
client.fimsexvietnam.com:8443
ryuk.fimsexvietnam.com:80
ryuk.fimsexvietnam.com:22
ryuk.fimsexvietnam.com:8080
ryuk.fimsexvietnam.com:8880
ryuk.fimsexvietnam.com:2052
ryuk.fimsexvietnam.com:2082
ryuk.fimsexvietnam.com:2086
ryuk.fimsexvietnam.com:2095
ryuk.fimsexvietnam.com:443
ryuk.fimsexvietnam.com:2053
ryuk.fimsexvietnam.com:2083
ryuk.fimsexvietnam.com:2087
ryuk.fimsexvietnam.com:2096
ryuk.fimsexvietnam.com:8443

Mutex

F4B0MKPvbUyl

Attributes

delay
0
install
true
install_file
hka1ba.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000e00000001c54d-10.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
2832	hka1ba.exe
260	hka1ba.exe

Outbound SSH connection to public host 2 TTPs 2 IoCs

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

command_and_control

Protocol Tunneling

T1572

Network Service Discovery

T1046

description	flow	ioc
SSH destination	10	104.21.36.7:22
SSH destination	11	172.67.182.173:22

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3008	cmd.exe
1480	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hka1ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hka1ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5008	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
Token: SeDebugPrivilege	2832	hka1ba.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 3008	1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe	89
PID 1248 wrote to memory of 1480	1248	6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe	90
PID 3008 wrote to memory of 2568	3008	cmd.exe	93
PID 1480 wrote to memory of 5008	1480	cmd.exe	94
PID 1480 wrote to memory of 260	1480	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe
"C:\Users\Admin\AppData\Local\Temp\6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "hka1ba" /tr '"C:\Users\Admin\AppData\Roaming\hka1ba.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "hka1ba" /tr '"C:\Users\Admin\AppData\Roaming\hka1ba.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4BC5.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5008
- - C:\Users\Admin\AppData\Roaming\hka1ba.exe
    "C:\Users\Admin\AppData\Roaming\hka1ba.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:260

C:\Users\Admin\AppData\Roaming\hka1ba.exe
"C:\Users\Admin\AppData\Roaming\hka1ba.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Protocol Tunneling

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4BC5.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4BC5.tmp.bat
Size 150B
SHA256 343add4c7087ce76ed87a06231c7862fe3083a4e8a1ba6dd32e6a3e15b12c2a8
MD5 2ad13069c6dd7023f2d9ff648d5e24ed
SHA1 78082eee78e1dc0db32d701fa76ad89219f65c0c
SHA512 a30a60297e3d746ad6922494a287fe1ba2daba981ef95b275bfccb80b9a08c5e609e4d533fd3e994b68612b131cd96777d7ad662e4936c1be51f3579ea48baab
TLSH
T1FEC02BA256C5FA4E6905742303FAE48D91B26C6D3F40FB00C704408D52C08C8F4DD345
MD5 SHA1 SHA512 TLSH

Submit Download

hka1ba.exe

Path C:\Users\Admin\AppData\Roaming\hka1ba.exe
Size 45KB
SHA256 6fd5ebd1dcfc76e64e9e6f396e7f625ed68c6950f046c10695e0b3f0b0156415
MD5 13e018ae1ae9464ca46fef0b5974764f
SHA1 3701685076fb63d79b8ed3748c7349d43831a044
SHA512 0de38464c7c5dfc212d47950c4a46c0e149bbfaf302a42e4eaf262cc175cb5a333146647f71085846abfc5d22359b9198b60aa222e969a9499f2999751114ff7
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9sZoyTM4PIXvjb+gX3iAPHxUkq5CDuqBDZ8x:0u1YJTHcw2dh0XbbBXSAPHCkq58ld8x
TLSH
T1D1231A0037E8822BF2BE5F78A9F26145867AF5673A03D58E1CC441DB5613FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-0-0x0000000074242000-0x0000000074243000-memory.dmp

Download

memory/1248-1-0x00000000000E0000-0x00000000000F2000-memory.dmp

Download

memory/1248-2-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/1248-3-0x0000000004C30000-0x0000000004CCC000-memory.dmp

Download

memory/1248-8-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/2832-12-0x00000000740C0000-0x000000007487C000-memory.dmp

Download

memory/2832-14-0x00000000740C0000-0x000000007487C000-memory.dmp

Download