asyncrat | a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
Size 45KB
Sample260804-rh63naca83
SHA256 a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b
MD5 eced6254487927bc517cd510fcfb1a5a
SHA1 af661ed46a929e57137a498aa0c5579b71247ffa
SHA512 baff67089d24511da0f2091956d013c4f42145c5ec3b38bf1d0ffe40cda94752997c232e74c6aac3527abc2bde695627bf185998f5b0a993d1cf2c34fd01353a
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwzNd3g4OcSOPI0nzjbLgXiiNMnQXljN06GVgrbBDZO:ku40ZTXEb29CES30n3b0XLNMnQX5+6c/
TLSH
T1BD232C0037E8C12BF27E4F78ACF26145867AF6632603D54A1CC452DB5623BC6DA526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

maymaykienlong.com:80
maymaykienlong.com:22
maymaykienlong.com:8080
maymaykienlong.com:8880
maymaykienlong.com:2052
maymaykienlong.com:2082
maymaykienlong.com:2086
maymaykienlong.com:2095
maymaykienlong.com:443
maymaykienlong.com:2053
maymaykienlong.com:2083
maymaykienlong.com:2087
maymaykienlong.com:2096
maymaykienlong.com:8443
www.maymaykienlong.com:80
www.maymaykienlong.com:22
www.maymaykienlong.com:8080
www.maymaykienlong.com:8880
www.maymaykienlong.com:2052
www.maymaykienlong.com:2082
www.maymaykienlong.com:2086
www.maymaykienlong.com:2095
www.maymaykienlong.com:443
www.maymaykienlong.com:2053
www.maymaykienlong.com:2083
www.maymaykienlong.com:2087
www.maymaykienlong.com:2096
www.maymaykienlong.com:8443
stuxnet.maymaykienlong.com:80
stuxnet.maymaykienlong.com:22
stuxnet.maymaykienlong.com:8080
stuxnet.maymaykienlong.com:8880
stuxnet.maymaykienlong.com:2052
stuxnet.maymaykienlong.com:2082
stuxnet.maymaykienlong.com:2086
stuxnet.maymaykienlong.com:2095
stuxnet.maymaykienlong.com:443
stuxnet.maymaykienlong.com:2053
stuxnet.maymaykienlong.com:2083
stuxnet.maymaykienlong.com:2087
stuxnet.maymaykienlong.com:2096
stuxnet.maymaykienlong.com:8443
malware.maymaykienlong.com:80
malware.maymaykienlong.com:22
malware.maymaykienlong.com:8080
malware.maymaykienlong.com:8880
malware.maymaykienlong.com:2052
malware.maymaykienlong.com:2082
malware.maymaykienlong.com:2086
malware.maymaykienlong.com:2095
malware.maymaykienlong.com:443
malware.maymaykienlong.com:2053
malware.maymaykienlong.com:2083
malware.maymaykienlong.com:2087
malware.maymaykienlong.com:2096
malware.maymaykienlong.com:8443
gh0st.maymaykienlong.com:80
gh0st.maymaykienlong.com:22
gh0st.maymaykienlong.com:8080
gh0st.maymaykienlong.com:8880
gh0st.maymaykienlong.com:2052
gh0st.maymaykienlong.com:2082
gh0st.maymaykienlong.com:2086
gh0st.maymaykienlong.com:2095
gh0st.maymaykienlong.com:443
gh0st.maymaykienlong.com:2053
gh0st.maymaykienlong.com:2083
gh0st.maymaykienlong.com:2087
gh0st.maymaykienlong.com:2096
gh0st.maymaykienlong.com:8443

Mutex

DCVYSvaprk7m

Attributes

delay
0
install
true
install_file
9ksbr.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000e00000001c535-10.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
3976	9ksbr.exe

Outbound SSH connection to public host 2 TTPs 2 IoCs

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

command_and_control

Protocol Tunneling

T1572

Network Service Discovery

T1046

description	flow	ioc
SSH destination	8	172.67.191.146:22
SSH destination	9	104.21.84.115:22

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
820	cmd.exe
4764	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ksbr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3704	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 820	1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe	89
PID 1032 wrote to memory of 4764	1032	a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe	91
PID 820 wrote to memory of 4008	820	cmd.exe	93
PID 4764 wrote to memory of 3704	4764	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe
"C:\Users\Admin\AppData\Local\Temp\a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "9ksbr" /tr '"C:\Users\Admin\AppData\Roaming\9ksbr.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "9ksbr" /tr '"C:\Users\Admin\AppData\Roaming\9ksbr.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB462.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3704
- - C:\Users\Admin\AppData\Roaming\9ksbr.exe
    "C:\Users\Admin\AppData\Roaming\9ksbr.exe"
    3⤵
    PID:5936

C:\Users\Admin\AppData\Roaming\9ksbr.exe
"C:\Users\Admin\AppData\Roaming\9ksbr.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Protocol Tunneling

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpB462.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpB462.tmp.bat
Size 149B
SHA256 f3c4255282ec4df8ca1a5e6f47d4c8f3ed55260e5411d97a40c6ecc269808f0f
MD5 426a352381d9cd8bc5de7e3587465388
SHA1 22bbd0de677656d2751d263f63acbb09ad91c9ba
SHA512 0a60b6d97ca6b3f1bd267e8d6a65b8231e6281db59c8db6e0392fc5a991392afae9fd8580e2ffd6e8cd5dcfddcc78edf97d043ddc892864d0dd97512f208e30c
TLSH
T1F5C02B93A1C5EE3F780518131AFBE4CCB1766C2A3F44BB00C358400D1280C49F0E9342
MD5 SHA1 SHA512 TLSH

Submit Download

9ksbr.exe

Path C:\Users\Admin\AppData\Roaming\9ksbr.exe
Size 45KB
SHA256 a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b
MD5 eced6254487927bc517cd510fcfb1a5a
SHA1 af661ed46a929e57137a498aa0c5579b71247ffa
SHA512 baff67089d24511da0f2091956d013c4f42145c5ec3b38bf1d0ffe40cda94752997c232e74c6aac3527abc2bde695627bf185998f5b0a993d1cf2c34fd01353a
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwzNd3g4OcSOPI0nzjbLgXiiNMnQXljN06GVgrbBDZO:ku40ZTXEb29CES30n3b0XLNMnQX5+6c/
TLSH
T1BD232C0037E8C12BF27E4F78ACF26145867AF6632603D54A1CC452DB5623BC6DA526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1032-0-0x0000000074E22000-0x0000000074E23000-memory.dmp

Download

memory/1032-1-0x0000000000E30000-0x0000000000E42000-memory.dmp

Download

memory/1032-2-0x0000000074E10000-0x00000000755CC000-memory.dmp

Download

memory/1032-3-0x00000000059C0000-0x0000000005A5C000-memory.dmp

Download

memory/1032-9-0x0000000074E10000-0x00000000755CC000-memory.dmp

Download

memory/3976-12-0x0000000074E10000-0x00000000755CC000-memory.dmp

Download

memory/3976-14-0x0000000074E10000-0x00000000755CC000-memory.dmp

Download