asyncrat | 6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478

Analysis

max time kernel
6s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
Size 45KB
Sample260821-shbr7asdla
SHA256 6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478
MD5 198069f8d3de03a73d47d8b6fc02a8f6
SHA1 5a56a9fb1138b480ab8ed01190c887a40f23629c
SHA512 65cdc69d6db6edf641ebc34ebacad0965d1d1c29622b34764e8179525b6f017006f688a95f0c9d424abd5624c9f13eed69694ccb956bb861276069a00d1fc1a0
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvZTohEaSPIkzjbjgX3iQbY6jBDZEx:MuLAZTnbg2O4Ea7k3b8XSeldEx
TLSH
T12B232A103BD8822BF2BE4F78A8F26145857AF6736603D55A2CC401D75713FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
rat.e.streamforester.name:80
rat.e.streamforester.name:22
rat.e.streamforester.name:8080
rat.e.streamforester.name:8880
rat.e.streamforester.name:2052
rat.e.streamforester.name:2082
rat.e.streamforester.name:2086
rat.e.streamforester.name:2095
rat.e.streamforester.name:443
rat.e.streamforester.name:2053
rat.e.streamforester.name:2083
rat.e.streamforester.name:2087
rat.e.streamforester.name:2096
rat.e.streamforester.name:8443
gh0st.e.streamforester.name:80
gh0st.e.streamforester.name:22
gh0st.e.streamforester.name:8080
gh0st.e.streamforester.name:8880
gh0st.e.streamforester.name:2052
gh0st.e.streamforester.name:2082
gh0st.e.streamforester.name:2086
gh0st.e.streamforester.name:2095
gh0st.e.streamforester.name:443
gh0st.e.streamforester.name:2053
gh0st.e.streamforester.name:2083
gh0st.e.streamforester.name:2087
gh0st.e.streamforester.name:2096
gh0st.e.streamforester.name:8443

Mutex

PDokELBSS6ew

Attributes

delay
0
install
true
install_file
s9506.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000e00000001c4c7-10.dat	family_asyncrat

Executes dropped EXE 2 IoCs

pid	Process
4144	s9506.exe
2128	s9506.exe

Outbound SSH connection to public host 2 TTPs 3 IoCs

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

command_and_control

Protocol Tunneling

T1572

Network Service Discovery

T1046

description	flow	ioc
SSH destination	10	104.26.4.5:22
SSH destination	11	104.26.5.5:22
SSH destination	13	172.67.70.147:22

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4688	cmd.exe
4964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s9506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s9506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3360	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
Token: SeDebugPrivilege	4144	s9506.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5576 wrote to memory of 4688	5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe	89
PID 5576 wrote to memory of 4964	5576	6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe	90
PID 4688 wrote to memory of 4512	4688	cmd.exe	93
PID 4964 wrote to memory of 3360	4964	cmd.exe	94
PID 4964 wrote to memory of 2128	4964	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe
"C:\Users\Admin\AppData\Local\Temp\6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "s9506" /tr '"C:\Users\Admin\AppData\Roaming\s9506.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "s9506" /tr '"C:\Users\Admin\AppData\Roaming\s9506.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6A0B.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3360
- - C:\Users\Admin\AppData\Roaming\s9506.exe
    "C:\Users\Admin\AppData\Roaming\s9506.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2128

C:\Users\Admin\AppData\Roaming\s9506.exe
"C:\Users\Admin\AppData\Roaming\s9506.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Protocol Tunneling

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp6A0B.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp6A0B.tmp.bat
Size 149B
SHA256 f3d688adec6483dd69bf8e0a0f36d3bc45bf37153a1c127b04987abaa97d070a
MD5 435b32f42602b95191689ddd1b053b36
SHA1 7d2147be41e2c46fdafbe7b8c667fd8d57c931b4
SHA512 2b5d35a6685f7252a14344d28a2c3fb95162b54b640884923272aa723467749e4f746cf9de241d2aa9ad88c4ef652f454c30585bf19d44137ae3ffb88d736385
TLSH
T107C02B8291C5EA1E3B05142303FBD58C91726C293F40FB10D344401E17C049EF4D9341
MD5 SHA1 SHA512 TLSH

Submit Download

s9506.exe

Path C:\Users\Admin\AppData\Roaming\s9506.exe
Size 45KB
SHA256 6744e4fab3426c50a1df0d46bf876e1053662cfbbbe51e68a99872f25a42f478
MD5 198069f8d3de03a73d47d8b6fc02a8f6
SHA1 5a56a9fb1138b480ab8ed01190c887a40f23629c
SHA512 65cdc69d6db6edf641ebc34ebacad0965d1d1c29622b34764e8179525b6f017006f688a95f0c9d424abd5624c9f13eed69694ccb956bb861276069a00d1fc1a0
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvZTohEaSPIkzjbjgX3iQbY6jBDZEx:MuLAZTnbg2O4Ea7k3b8XSeldEx
TLSH
T12B232A103BD8822BF2BE4F78A8F26145857AF6736603D55A2CC401D75713FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4144-12-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/4144-14-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5576-0-0x0000000074A12000-0x0000000074A13000-memory.dmp

Download

memory/5576-1-0x0000000000570000-0x0000000000582000-memory.dmp

Download

memory/5576-2-0x0000000074A00000-0x00000000751BC000-memory.dmp

Download

memory/5576-3-0x0000000004FA0000-0x000000000503C000-memory.dmp

Download

memory/5576-8-0x0000000074A00000-0x00000000751BC000-memory.dmp

Download