asyncrat | 11347344c13fc20791b4efe37ea517649ba65b27de86b721097f490f19d6a8c4

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11347344c13fc20791b4efe37ea517649ba65b27de86b721097f490f19d6a8c4.ps1
Size 77KB
Sample260821-dtsgrasala
SHA256 11347344c13fc20791b4efe37ea517649ba65b27de86b721097f490f19d6a8c4
MD5 d690e64605966276719c2aa1d51d4a0e
SHA1 03f60fbc7eaa7555e3908acf0a4cc16decd31f9a
SHA512 a17db2c55bc5be6c16cc8a74eefce8f280b115162c0bdc34d92ed3c0da695db634feb027a86b9f2d85a87045972faccc2a1aa21709a7f23baf49a47e60144168
SSDEEP 1536:Q4lHL2GJMrunkHzR2rNFvfN/h1rxEDmOvlO6tOLzI:Qk/SHVmRfNzrxYvNOsmI
TLSH
T13773020338ACED9B368702A4E5B64ACF5A5459271809AD30F82CF19A676D53367B83F4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

11agosto execution asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

11AGOSTO

onepicce.ydns.eu:15009
comienzo.ydns.eu:15009

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4828 set thread context of 2812	4828	PowerShell.exe	92

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4828	PowerShell.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4516	2812	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4828	PowerShell.exe
4828	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	PowerShell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4744	4828	PowerShell.exe	90
PID 4744 wrote to memory of 5052	4744	csc.exe	91
PID 4828 wrote to memory of 2812	4828	PowerShell.exe	92
PID 4828 wrote to memory of 2812	4828	PowerShell.exe	92
PID 4828 wrote to memory of 2812	4828	PowerShell.exe	92
PID 4828 wrote to memory of 2812	4828	PowerShell.exe	92
PID 4828 wrote to memory of 2812	4828	PowerShell.exe	92

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\11347344c13fc20791b4efe37ea517649ba65b27de86b721097f490f19d6a8c4.ps1
1⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f0ssy5ku\f0ssy5ku.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES76EB.tmp" "c:\Users\Admin\AppData\Local\Temp\f0ssy5ku\CSCA96C978D973646CA8EAC425C1623299E.TMP"
    3⤵
    PID:5052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
  2⤵
  PID:2812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 284
    3⤵
    - Program crash
    PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2812 -ip 2812
1⤵
PID:364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES76EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES76EB.tmp
Size 1KB
SHA256 47d820149cfb4de93a329441d3f8d4cf7bcd5f5dc010fc1593fe590e33f022f3
MD5 d06cfd89abb8dcb7395aa2741b3babc9
SHA1 ed28e8b4bf2a46e054567980c51e700e02bf2b52
SHA512 7050470375bafece1ea2d63b3da4cbaa5396d471ada1af31d82ed26a045b78d5a2be729f189dbe9e7320cc586abd5051dcb0edeaf5b346427c4861315d5a796d
TLSH
T17A21CC0553E84B1FF0B75B31A9F6571F9234FC68DFA2975A954043282841544EEB1B72
MD5 SHA1 SHA512 TLSH

Submit Download

f0ssy5ku.dll

Path C:\Users\Admin\AppData\Local\Temp\f0ssy5ku\f0ssy5ku.dll
Size 3KB
SHA256 eeb2e34c0b8be2a8130728d9129c170c4c5302f9cadee23dc855763a0a13beac
MD5 7053cd916e381390ccc7ee9fa4fcc84d
SHA1 badad6082e6c862e13628b0e9540169ea35a5ace
SHA512 9acd06477b110b550b8caa2932eaa6e7b089ba1822ccd71da7deadd45f472386c99974c32369ba956e11aba6e2277a40511c50e421ce289f8a5dfb7b97a68ad9
TLSH
T15F51CB1A57E84A2BE4770B35ADF3471677B4FC509FB2A35E59904228AC606648E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA96C978D973646CA8EAC425C1623299E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\f0ssy5ku\CSCA96C978D973646CA8EAC425C1623299E.TMP
Size 652B
SHA256 b7759ee97ce83ccc5a8398d0fdbc3c67bb5a67a0e03be4ad810a46d35f6eec8c
MD5 b3b2cc4d33c10de431a1f3bb22474ba0
SHA1 ce1c5255acb599e313687524bebd6c95db93df66
SHA512 627bc12c6f6aa97666865a3711675a195b1f8218a27bb5055fae97ea756447477c942317ca1dd077ae8d768d63b9aa734d3168a7e0279f1a6203564aee491713
TLSH
T1AFF03A0963F8020AF0F34B70F9F6436391A9BC65DE7293ED544043292864510C972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

f0ssy5ku.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\f0ssy5ku\f0ssy5ku.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

f0ssy5ku.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\f0ssy5ku\f0ssy5ku.cmdline
Size 369B
SHA256 fc6fef9639f92fbd9c7089d59dd1cada163debaed4461ba284548cad3edcc4e1
MD5 670bdf7095f3e87086353bc7522a6030
SHA1 9ba19cf59de8dbf439a2943f881d39b58bbb543a
SHA512 db165103f17ad875a936c15808eae9c5d624c2346be1b12c55bc03e6806bd678a90f93e20fa033952b2c7c4f705aff5d409dee6b3c9d84de0c2ca29d73348197
TLSH
T151E0C62A4246C27D03FD320F227ACDACC2B2078329893FC8E080840EE0670103BF2792
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2812-34-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4828-9-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-8-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-10-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-11-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-12-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-13-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-14-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-15-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-16-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-17-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-18-0x0000023A63540000-0x0000023A63556000-memory.dmp

Download

memory/4828-0-0x00007FFB7A1CF000-0x00007FFB7A1D0000-memory.dmp

Download

memory/4828-24-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-7-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-32-0x0000023A63550000-0x0000023A63558000-memory.dmp

Download

memory/4828-6-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-5-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-1-0x0000023A634D0000-0x0000023A634F2000-memory.dmp

Download

memory/4828-2-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-33-0x0000023A63560000-0x0000023A63568000-memory.dmp

Download

memory/4828-35-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4828-37-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download