asyncrat | 8033b0d221ed734e6e14eeb4f9b11f3379f7a32fb44a8e5c77c05cac7a00d604

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Đơn đặt hàng mới Inv.534.js
Size 263KB
Sample260820-jt2cjssdpf
SHA256 8033b0d221ed734e6e14eeb4f9b11f3379f7a32fb44a8e5c77c05cac7a00d604
MD5 7812a7f9a9f806341ec3e1fd021202ad
SHA1 e2fefbef4ef669d8c4e6ee428c64335b65e2870a
SHA512 8c4c05de53b11857378f27644179b22dd55866a936c9eaed82682e0ef99972636f47bcc0f67b227a519bfb3f97b87d0b9f24a100f41ed8dec8db6fbf46decc1a
SSDEEP 6144:XM05D6a5Kd5/X/jr3PtAXHmfj6AtZLRcqwZNzc00KHz+f+tANHiprsCRo541zz:805DaPbB/VXdcvNzc9KMNCpx
TLSH
T17444AE05539C039CAB149BE8551F4B4618E2ED4B2DFBE0C0ABD6CBE36A17CE584B5E70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

64.89.160.127:6680

Mutex

hJF0mOkFuWCU

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
468	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 468 set thread context of 1688	468	powershell.exe	95

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
468	powershell.exe
468	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	468	powershell.exe
Token: SeDebugPrivilege	1688	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 468	4192	wscript.exe	91
PID 468 wrote to memory of 2080	468	powershell.exe	93
PID 2080 wrote to memory of 1932	2080	csc.exe	94
PID 468 wrote to memory of 1688	468	powershell.exe	95
PID 468 wrote to memory of 1688	468	powershell.exe	95
PID 468 wrote to memory of 1688	468	powershell.exe	95
PID 468 wrote to memory of 1688	468	powershell.exe	95
PID 468 wrote to memory of 1688	468	powershell.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Đơn đặt hàng mới Inv.534.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\15l6udxp\tmp_44223_ec4b.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wi3ogwp2\wi3ogwp2.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES773A.tmp" "c:\Users\Admin\AppData\Local\Temp\wi3ogwp2\CSC1019BC33E1174B8983BB93B738D09CB4.TMP"
      4⤵
      PID:1932
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1688

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp_44223_ec4b.ps1

Path C:\Users\Admin\AppData\Local\Temp\15l6udxp\tmp_44223_ec4b.ps1
Size 75KB
SHA256 bf1cb5591920b530b876ec4e740e5d43e7af13ce34eaa63b8219e322d028ba7d
MD5 be110d24486cfd42b850040a12b99a79
SHA1 cfee43e9e4e9fad5793e718daadea83973ebaa41
SHA512 47037302edc6d98807158a583a58eafd1a800543c45bb6bbaf0bc02f66fb9ba1e66714b3b4635b0551c39c6fd0d2935e12dc82c1105753d2b809b768c9ba9626
SSDEEP 1536:0Lw9RXwBrAQIHCaRYg1u8EFCHfEG1j1wnp/bJM5Ao3I+DZdihwmZyUMzM:0MRXwRIDYg1u8EFCHl1ZU/bN0I+diqM
TLSH
T10473F21758FC8BBD03D7295D68FA2384F289003544DF58F8769ECE64BBDA0A931A21D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES773A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES773A.tmp
Size 1KB
SHA256 65924a8028c9ee5cadbfc5441d081715a226faa6d4d640629fb190319d13892b
MD5 984fbb439261c94ee9bf34bd6e0cadde
SHA1 d0e2e6062d7db73dadefe00c7add594a2f651c34
SHA512 972248817b250b0e75e1849bdecee3b993e996bcb986e3db8c17553031e4c617755732de8f6dde9cc4f5dfb373d5bf9217d1e93c43ab18ba87cd615b753420cc
TLSH
T11A216A0A93E8471EF0735731A9F6131FA138FD65DFA2579B854052282C51144EEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

wi3ogwp2.dll

Path C:\Users\Admin\AppData\Local\Temp\wi3ogwp2\wi3ogwp2.dll
Size 3KB
SHA256 c9d9b17e3503325d14f76076c46d836cb6701dec8e023d7bb22dfaad7587b376
MD5 8fd04174a61a6ceead101cc1e9fa05cc
SHA1 ba01588301bf4bfe08910531f68080709722faab
SHA512 27f419f6f17153109bbd963be02a92bd025e3f1456a6fb9b88753fea29ea3ae712e690fe2dd5a567fdc8d9a5d1c07cc5b562196c6368177889874b048c3c78a3
TLSH
T15751DD1B67E8862BF47307306DF3431677B8FC108BB3575E5D905228AC216645E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1019BC33E1174B8983BB93B738D09CB4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wi3ogwp2\CSC1019BC33E1174B8983BB93B738D09CB4.TMP
Size 652B
SHA256 aa7775afb1a2af574d329b017d199b3d12b021ba694d10e0568282c248fa5fbd
MD5 4bb260d5b4695a53bc3a9f189d8a56d8
SHA1 bf289323422fb8d53614fa662cfe3911489a7f06
SHA512 763f16dab6492031bad9e06a15be9f211fe9cecc80907f005b42f58d838413eeea706bb0e68f90578406edff81cc46b27efb9942daa7038b043001760665c2f5
TLSH
T1DFF05E0A73F8020EF0F34B30BDF65367A1A8BC65DE3297ED248013192C646209962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

wi3ogwp2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wi3ogwp2\wi3ogwp2.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

wi3ogwp2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wi3ogwp2\wi3ogwp2.cmdline
Size 369B
SHA256 df6e7c39ed8eab5ce424021b6fff8f090eaf570b6f3a2a166557b26be2a4e039
MD5 43bb55fe3e6151d93fc65c3ff815fc24
SHA1 2eb840b14cb593fe3edd766f1d48424b2c3f0ed4
SHA512 2e5cef04930aa627089a36c79d3652176d653a4b81f8f9c9e13f6b5cbbf56786ab47102b974e09474a31ebe11001954b959e7c0cf52985f722c28515361eaa0e
TLSH
T1EFE0C62F4346C27D03ED200B726AC8ACC27A87832A803F84B06084BEE0370002BD3789
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-8-0x0000000005A20000-0x0000000005A86000-memory.dmp

Download

memory/468-5-0x0000000005320000-0x000000000596A000-memory.dmp

Download

memory/468-12-0x0000000005FE0000-0x0000000005FFE000-memory.dmp

Download

memory/468-13-0x0000000006070000-0x00000000060BC000-memory.dmp

Download

memory/468-2-0x0000000074C02000-0x0000000074C03000-memory.dmp

Download

memory/468-15-0x0000000074BF0000-0x00000000753AC000-memory.dmp

Download

memory/468-16-0x0000000007820000-0x0000000007E9C000-memory.dmp

Download

memory/468-17-0x00000000071A0000-0x00000000071BA000-memory.dmp

Download

memory/468-18-0x00000000071F0000-0x0000000007206000-memory.dmp

Download

memory/468-7-0x00000000052B0000-0x0000000005316000-memory.dmp

Download

memory/468-6-0x0000000005210000-0x0000000005232000-memory.dmp

Download

memory/468-11-0x0000000005AD0000-0x0000000005E2B000-memory.dmp

Download

memory/468-4-0x0000000074BF0000-0x00000000753AC000-memory.dmp

Download

memory/468-3-0x0000000002B10000-0x0000000002B46000-memory.dmp

Download

memory/468-31-0x0000000007230000-0x0000000007238000-memory.dmp

Download

memory/468-32-0x0000000004DE0000-0x0000000004DE8000-memory.dmp

Download

memory/468-38-0x0000000074BF0000-0x00000000753AC000-memory.dmp

Download

memory/468-34-0x0000000007320000-0x00000000073B6000-memory.dmp

Download

memory/468-35-0x00000000072C0000-0x00000000072E2000-memory.dmp

Download

memory/468-36-0x0000000008460000-0x0000000008A1A000-memory.dmp

Download

memory/1688-33-0x0000000000400000-0x0000000000412000-memory.dmp

Download