asyncrat | 420c51c77a02c755599e1962b24156c7791a86f21bd0e6124bec6641794829ae

Analysis

max time kernel
60s
max time network
55s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
420c51c77a02c755599e1962b24156c7791a86f21bd0e6124bec6641794829ae.exe
Size 48KB
Sample260819-xtp66styat
SHA256 420c51c77a02c755599e1962b24156c7791a86f21bd0e6124bec6641794829ae
MD5 a35af328b83be0be34f5373c9219652e
SHA1 64a42d92e3d9c3580cb6c60355d71b217588bea9
SHA512 6f4168029863cbdf17bf3995138993a3bcc90fb6c75d2b8fcd70459690991667272ced59fd18e36d491271ec7a9c068dfa9443d8af968e875ba7e70db1b7f074
SSDEEP 768:+fWC+K+uILuCi6+DiJtSWBKrN+iV08YbygeWSbm9tuEgK/J0zpqKYhY7:+fjbnuJt1BY4zb1/9tokJ0zpqKmY7
TLSH
T148237D403BD88136F2BD8BB4ADF2A18187B9D6272903C65E5DC814E91B03BC596436FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

lili5202

Botnet

Default

112.213.124.162:8848

Mutex

BD82237642552750F218

Attributes

delay
3
install
true
install_file
win.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0003000000000432-9.dat	family_asyncrat

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5056	cmd.exe
4208	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	420c51c77a02c755599e1962b24156c7791a86f21bd0e6124bec6641794829ae.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4248	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
720	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\420c51c77a02c755599e1962b24156c7791a86f21bd0e6124bec6641794829ae.exe
"C:\Users\Admin\AppData\Local\Temp\420c51c77a02c755599e1962b24156c7791a86f21bd0e6124bec6641794829ae.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:5056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp303E.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  PID:4208
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4248
- - C:\Users\Admin\AppData\Roaming\win.exe
    "C:\Users\Admin\AppData\Roaming\win.exe"
    3⤵
    PID:3340

C:\Users\Admin\AppData\Roaming\win.exe
"C:\Users\Admin\AppData\Roaming\win.exe"
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp303E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp303E.tmp.bat
Size 147B
SHA256 717ab1409b6081d2589284dc27ecef53e2964a99050eb9808f8dd1c29cf96d01
MD5 fcde2f9d8d5828ed15846b36ea3fe003
SHA1 95656c030b10e4af4b3cc1f09f606ac6980fb8d3
SHA512 683452bf7a891b70e3adcd094792c5a65804b21b0c53191956e1fbf62cd9c597a11bb3914bd94bec131ce335b34f7528fa07cc4ca663cb3ea4b4c4ddd106122f
TLSH
T1C3C08C5351C5AA0EA809141302BA998C916268193E40AB10830440192681849E09D345
MD5 SHA1 SHA512 TLSH

Submit Download

win.exe

Path C:\Users\Admin\AppData\Roaming\win.exe
Size 48KB
SHA256 420c51c77a02c755599e1962b24156c7791a86f21bd0e6124bec6641794829ae
MD5 a35af328b83be0be34f5373c9219652e
SHA1 64a42d92e3d9c3580cb6c60355d71b217588bea9
SHA512 6f4168029863cbdf17bf3995138993a3bcc90fb6c75d2b8fcd70459690991667272ced59fd18e36d491271ec7a9c068dfa9443d8af968e875ba7e70db1b7f074
SSDEEP 768:+fWC+K+uILuCi6+DiJtSWBKrN+iV08YbygeWSbm9tuEgK/J0zpqKYhY7:+fjbnuJt1BY4zb1/9tokJ0zpqKmY7
TLSH
T148237D403BD88136F2BD8BB4ADF2A18187B9D6272903C65E5DC814E91B03BC596436FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4372-0-0x00000000744B2000-0x00000000744B3000-memory.dmp

Download

memory/4372-1-0x0000000000F60000-0x0000000000F72000-memory.dmp

Download

memory/4372-2-0x00000000744A0000-0x0000000074C5C000-memory.dmp

Download

memory/4372-8-0x00000000744A0000-0x0000000074C5C000-memory.dmp

Download

memory/4704-11-0x00000000744A0000-0x0000000074C5C000-memory.dmp

Download

memory/4704-13-0x00000000744A0000-0x0000000074C5C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads