asyncrat | b78b4ebc72a3689ab5689846395f9a09821284e502b2fac2b0970f51ef2def5c

Analysis

max time kernel
16s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
grfgfa6jd6lwo913.exe
Size 76KB
Sample260809-dpq35ayhlb
SHA256 b78b4ebc72a3689ab5689846395f9a09821284e502b2fac2b0970f51ef2def5c
MD5 29fab259fa44d69e14f60b1c64b0c01c
SHA1 e3c2c5779c0f29feb7b4ee18acc0225b362c2c58
SHA512 e4a09ab2d4d53b7f9cd24687e01b5d5c7f8bc4a13808d8a527ba0f1421630101c68e0c05f0e7d15aef8785f536410a926a755cb78af78b296dd56b225fa55331
SSDEEP 1536:Ym60OoRRl6hcCe4+sPNHJGaW4blHdUm+3asQaBXgJj3al5VNF+:Yl0O6RR4+wNpGaW4bl9Ga44j+5TQ
TLSH
T1DE736C447BE8812AF2BE8BB49CB261054675F5236B23D75E0DC415E90A62FC1A7037FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution asyncrat persistence privilege_escalation rat

Malware Config

Extracted

Family

asyncrat

Version

true

Mutex

wh3)p4o2&!p6!j6afx97+oym*t

Attributes

delay
0
install
false
install_file
WindowsHealthService
install_folder
$pwnWindowsHealth.exe

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\Music\\$pwnWindowsHealth.exe"	grfgfa6jd6lwo913.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4412	powershell.exe
4412	powershell.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3256	netsh.exe
2116	netsh.exe
4144	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
2416	$pwnWindowsHealth.exe
1008	$pwnWindowsHealth.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4624	cmd.exe
2740	cmd.exe
6072	cmd.exe
2852	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5616	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
5716	grfgfa6jd6lwo913.exe
4412	powershell.exe
4412	powershell.exe
4412	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	5716	grfgfa6jd6lwo913.exe
Token: SeIncBasePriorityPrivilege	5716	grfgfa6jd6lwo913.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeIncreaseQuotaPrivilege	4412	powershell.exe
Token: SeSecurityPrivilege	4412	powershell.exe
Token: SeTakeOwnershipPrivilege	4412	powershell.exe
Token: SeLoadDriverPrivilege	4412	powershell.exe
Token: SeSystemProfilePrivilege	4412	powershell.exe
Token: SeSystemtimePrivilege	4412	powershell.exe
Token: SeProfSingleProcessPrivilege	4412	powershell.exe
Token: SeIncBasePriorityPrivilege	4412	powershell.exe
Token: SeCreatePagefilePrivilege	4412	powershell.exe
Token: SeBackupPrivilege	4412	powershell.exe
Token: SeRestorePrivilege	4412	powershell.exe
Token: SeShutdownPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeSystemEnvironmentPrivilege	4412	powershell.exe
Token: SeRemoteShutdownPrivilege	4412	powershell.exe
Token: SeUndockPrivilege	4412	powershell.exe
Token: SeManageVolumePrivilege	4412	powershell.exe
Token: 33	4412	powershell.exe
Token: 34	4412	powershell.exe
Token: 35	4412	powershell.exe
Token: 36	4412	powershell.exe
Token: SeIncreaseQuotaPrivilege	4412	powershell.exe
Token: SeSecurityPrivilege	4412	powershell.exe
Token: SeTakeOwnershipPrivilege	4412	powershell.exe
Token: SeLoadDriverPrivilege	4412	powershell.exe
Token: SeSystemProfilePrivilege	4412	powershell.exe
Token: SeSystemtimePrivilege	4412	powershell.exe
Token: SeProfSingleProcessPrivilege	4412	powershell.exe
Token: SeIncBasePriorityPrivilege	4412	powershell.exe
Token: SeCreatePagefilePrivilege	4412	powershell.exe
Token: SeBackupPrivilege	4412	powershell.exe
Token: SeRestorePrivilege	4412	powershell.exe
Token: SeShutdownPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeSystemEnvironmentPrivilege	4412	powershell.exe
Token: SeRemoteShutdownPrivilege	4412	powershell.exe
Token: SeUndockPrivilege	4412	powershell.exe
Token: SeManageVolumePrivilege	4412	powershell.exe
Token: 33	4412	powershell.exe
Token: 34	4412	powershell.exe
Token: 35	4412	powershell.exe
Token: 36	4412	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5716 wrote to memory of 4624	5716	grfgfa6jd6lwo913.exe	89
PID 4624 wrote to memory of 5988	4624	cmd.exe	91
PID 5716 wrote to memory of 2740	5716	grfgfa6jd6lwo913.exe	92
PID 2740 wrote to memory of 1984	2740	cmd.exe	94
PID 5716 wrote to memory of 6072	5716	grfgfa6jd6lwo913.exe	95
PID 6072 wrote to memory of 3256	6072	cmd.exe	97
PID 6072 wrote to memory of 2116	6072	cmd.exe	99
PID 5716 wrote to memory of 4412	5716	grfgfa6jd6lwo913.exe	100
PID 6072 wrote to memory of 4144	6072	cmd.exe	102
PID 5716 wrote to memory of 2852	5716	grfgfa6jd6lwo913.exe	104
PID 2852 wrote to memory of 5616	2852	cmd.exe	106
PID 2852 wrote to memory of 1008	2852	cmd.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\grfgfa6jd6lwo913.exe
"C:\Users\Admin\AppData\Local\Temp\grfgfa6jd6lwo913.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /delete /f /tn "WindowsHealthService" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /f /tn "WindowsHealthService"
    3⤵
    PID:5988
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /rl highest /tn "WindowsHealthService" /tr "\"C:\Users\Admin\Music\$pwnWindowsHealth.exe\"" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /rl highest /tn "WindowsHealthService" /tr "\"C:\Users\Admin\Music\$pwnWindowsHealth.exe\""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1984
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall delete rule name="Windows Control" & netsh advfirewall firewall add rule name="Windows Control" dir=in action=allow program="C:\Users\Admin\Music\$pwnWindowsHealth.exe" enable=yes & netsh advfirewall firewall add rule name="Windows Control_out" dir=out action=allow program="C:\Users\Admin\Music\$pwnWindowsHealth.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6072
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="Windows Control"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3256
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Control" dir=in action=allow program="C:\Users\Admin\Music\$pwnWindowsHealth.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2116
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Control_out" dir=out action=allow program="C:\Users\Admin\Music\$pwnWindowsHealth.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\Music" -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\grfgfa6jd6lwo913.exe" -ErrorAction SilentlyContinue; "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4D6A.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:5616
- - C:\Users\Admin\Music\$pwnWindowsHealth.exe
    "C:\Users\Admin\Music\$pwnWindowsHealth.exe"
    3⤵
    - Executes dropped EXE
    PID:1008

C:\Users\Admin\Music\$pwnWindowsHealth.exe
"C:\Users\Admin\Music\$pwnWindowsHealth.exe"
1⤵
- Executes dropped EXE
PID:2416

C:\Users\Admin\Music\$pwnWindowsHealth.exe
"C:\Users\Admin\Music\$pwnWindowsHealth.exe"
1⤵
PID:3420

C:\Users\Admin\Music\$pwnWindowsHealth.exe
"C:\Users\Admin\Music\$pwnWindowsHealth.exe"
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4D6A.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4D6A.tmp.bat
Size 151B
SHA256 3e7076db32d07d7766d8390010bed3525810a7131c4649a82994586cc94f6522
MD5 45f208071d5717463ddbcc03d57f71b6
SHA1 3574c18baf060425c5afe53e510bb21e58552ac7
SHA512 cb241379f137a91778b661af8d00f9174250d06be2f4d3a9ba70ce18c2ad6abee99978540c69dfff91af9984b6fd7e7f1fde93084d15125abb5f597089254818
TLSH
T1AAC08C826999A95A2A04641312BAE6DDA16A2D2A3F41B78083484186754085EE4AA282
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4412-20-0x000002460A340000-0x000002460A362000-memory.dmp

Download

memory/4412-25-0x0000024622700000-0x000002462270A000-memory.dmp

Download

memory/4412-24-0x0000024622640000-0x00000246226F2000-memory.dmp

Download

memory/4412-23-0x0000024622620000-0x000002462263E000-memory.dmp

Download

memory/5716-5-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-12-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-7-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-8-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-9-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-10-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-11-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-6-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-13-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-14-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-0-0x000001A6B13C0000-0x000001A6B13DA000-memory.dmp

Download

memory/5716-4-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-3-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-2-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-28-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/5716-1-0x00007FFC9299F000-0x00007FFC929A0000-memory.dmp

Download