asyncrat | fee90f131e233d48b13cef72fb637b8057ad722ffb0785f61c346ec79ba3e2fe

Analysis

max time kernel
149s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DcRatHelp.exe
Size 63KB
Sample260809-m6td9azvav
SHA256 fee90f131e233d48b13cef72fb637b8057ad722ffb0785f61c346ec79ba3e2fe
MD5 c36a6d8f6795c3c203d65cde50cda06c
SHA1 127b10e0902f126c7c11255dd098a8c99db84cd9
SHA512 0165cebe00dd52c44a39f01f5678ed962cdc5a04f051d1b618d8b03912a799d4b354ae62e05fe37144346db1ceb1cea239f84a80249042b47d6420934b46fa25
SSDEEP 1536:fEIo5EfZ3R/IVUzNY5Gbbrwv0Q4oyZGBZVclN:fy5EfZ3RwwNUGbbrfwyYzY
TLSH
T1D7536B002798CA65E2AD4AF4ACF2950106B5D5772102DB5E7CC814DBAB9FFC64A133EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

dcrat defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

DcRat

Mutex

yuwdgywgbdg_2hdc7h

Attributes

delay
1
install
true
install_file
DcRat Helper.exe
install_folder
%Temp%
pastebin_config
https://pastebin.com/raw/tqymu4XX

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000e00000001c485-16.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2124	DcRat Helper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4108	cmd.exe
4116	cmd.exe
5872	cmd.exe
3956	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4300	timeout.exe
4200	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe
2524	DcRatHelp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2524	DcRatHelp.exe
Token: SeDebugPrivilege	2524	DcRatHelp.exe
Token: SeDebugPrivilege	2124	DcRat Helper.exe
Token: SeDebugPrivilege	2124	DcRat Helper.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 4116	2524	DcRatHelp.exe	89
PID 2524 wrote to memory of 4108	2524	DcRatHelp.exe	90
PID 4108 wrote to memory of 4300	4108	cmd.exe	93
PID 4116 wrote to memory of 4668	4116	cmd.exe	94
PID 4108 wrote to memory of 2124	4108	cmd.exe	95
PID 2124 wrote to memory of 5872	2124	DcRat Helper.exe	98
PID 2124 wrote to memory of 3956	2124	DcRat Helper.exe	100
PID 3956 wrote to memory of 4200	3956	cmd.exe	102
PID 5872 wrote to memory of 1396	5872	cmd.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DcRatHelp.exe
"C:\Users\Admin\AppData\Local\Temp\DcRatHelp.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "DcRat Helper" /tr '"C:\Users\Admin\AppData\Local\Temp\DcRat Helper.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "DcRat Helper" /tr '"C:\Users\Admin\AppData\Local\Temp\DcRat Helper.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp853.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\DcRat Helper.exe
    "C:\Users\Admin\AppData\Local\Temp\DcRat Helper.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "DcRat Helper"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5872
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "DcRat Helper"
        5⤵
        
        PID:1396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF459.tmp.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3956
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DcRat Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\DcRat Helper.exe
Size 63KB
SHA256 fee90f131e233d48b13cef72fb637b8057ad722ffb0785f61c346ec79ba3e2fe
MD5 c36a6d8f6795c3c203d65cde50cda06c
SHA1 127b10e0902f126c7c11255dd098a8c99db84cd9
SHA512 0165cebe00dd52c44a39f01f5678ed962cdc5a04f051d1b618d8b03912a799d4b354ae62e05fe37144346db1ceb1cea239f84a80249042b47d6420934b46fa25
SSDEEP 1536:fEIo5EfZ3R/IVUzNY5Gbbrwv0Q4oyZGBZVclN:fy5EfZ3RwwNUGbbrfwyYzY
TLSH
T1D7536B002798CA65E2AD4AF4ACF2950106B5D5772102DB5E7CC814DBAB9FFC64A133EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp853.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp853.tmp.bat
Size 158B
SHA256 14d513185437ba65038574c8957b45a3bba03411c4c67fc1e5074e419cf45d8e
MD5 08d0aebb6619f9c3926e998a6a5c625a
SHA1 130c6c94039dfaa24d77c20725637627d79a3877
SHA512 50122b6a8fa954aecc205a432c2145a4f98aa2f89bdc7bcffc402bce35eb23499d0c428308a98d0f8e7037ab4d19277ce5f720313db1e6e78cee50e0b5a6d2af
TLSH
T1E0C08C83A5CBAA1E1848A42302BAA69C92626C1D3F85AB108314841A668485AE0E9741
MD5 SHA1 SHA512 TLSH

Submit Download

tmpF459.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpF459.tmp.bat
Size 164B
SHA256 dc0021a6e7deb3197b1548f231111c1c8562a588a98242bc3226281f2d5f4482
MD5 97170522e0adaaf4060b8860714512c8
SHA1 ccdc843d195ae4b9efb2861e80f5369caed11935
SHA512 2dae5694cc31fe7ef9b95ec04fee0f844f9c00cc47ac6b81308684d7c27a2589340da03bc3a9b20dcfbea2d4ef869b326fa1e4fb52174cf3a19f29ddc976c640
TLSH
T122C08C422ACFFA0A2A8AA81701B6E09DD0625C4A3F886B20A3588819288049CE4B4B05
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2124-22-0x000000001D4E0000-0x000000001D4FE000-memory.dmp

Download

memory/2124-21-0x000000001D480000-0x000000001D4E6000-memory.dmp

Download

memory/2124-20-0x000000001D500000-0x000000001D576000-memory.dmp

Download

memory/2524-4-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/2524-7-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/2524-8-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/2524-9-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/2524-13-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/2524-6-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/2524-5-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/2524-0-0x00007FF8C7C6F000-0x00007FF8C7C70000-memory.dmp

Download

memory/2524-3-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/2524-2-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp

Download

memory/2524-1-0x00000000008E0000-0x00000000008F6000-memory.dmp

Download