asyncrat | 155d1dce8e17b107b531b80b648f1a3fcbcbed764d76a39b0b3972d9424dd2f7

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ven9392.exe
Size 3.3MB
Sample260827-pmjrtavanb
SHA256 155d1dce8e17b107b531b80b648f1a3fcbcbed764d76a39b0b3972d9424dd2f7
MD5 0268fde13e99c555ed4a4c6ef193b9ea
SHA1 ff5db489782f10217946f75450803f6c835108c5
SHA512 d6cefe8aa77a13d64eccbc121368d3f0cc36a954b91cb79d463c1634bef5b3d71ccf9d0e3675d51a3972797bcaf1047b92ee43fc04bf757e452edb2501cc6baa
SSDEEP 49152:4HSarve2wIDiFilNkzVMWzU0hdBdo+6WuDayPAr/NJJ8:4i29Dxb8h
TLSH
T162F54B41ABE8CE1BE1BF2775A4F200125BB1E449E732DB4B1694E6792C637406D0A37F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution asyncrat stormkitty persistence rat stealer

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000e00000001c515-11.dat	family_asyncrat

StormKitty payload 2 IoCs

resource	yara_rule
behavioral2/memory/4660-1-0x0000000000CB0000-0x0000000000FFA000-memory.dmp	family_stormkitty
behavioral2/files/0x000e00000001c515-11.dat	family_stormkitty

Executes dropped EXE 2 IoCs

pid	Process
4088	Wihnup.exe
2612	Wihnup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4316	cmd.exe
4980	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4500	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe
4660	ven9392.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4660	ven9392.exe
Token: SeDebugPrivilege	4660	ven9392.exe
Token: SeDebugPrivilege	4088	Wihnup.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4980	4660	ven9392.exe	90
PID 4660 wrote to memory of 4316	4660	ven9392.exe	92
PID 4980 wrote to memory of 4772	4980	cmd.exe	94
PID 4316 wrote to memory of 4500	4316	cmd.exe	95
PID 4316 wrote to memory of 2612	4316	cmd.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ven9392.exe
"C:\Users\Admin\AppData\Local\Temp\ven9392.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Wihnup" /tr '"C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Wihnup" /tr '"C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA1A5.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4500
- - C:\Users\Admin\AppData\Local\Temp\Wihnup.exe
    "C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"
    3⤵
    - Executes dropped EXE
    PID:2612

C:\Users\Admin\AppData\Local\Temp\Wihnup.exe
"C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Wihnup.exe

Path C:\Users\Admin\AppData\Local\Temp\Wihnup.exe
Size 3.3MB
SHA256 155d1dce8e17b107b531b80b648f1a3fcbcbed764d76a39b0b3972d9424dd2f7
MD5 0268fde13e99c555ed4a4c6ef193b9ea
SHA1 ff5db489782f10217946f75450803f6c835108c5
SHA512 d6cefe8aa77a13d64eccbc121368d3f0cc36a954b91cb79d463c1634bef5b3d71ccf9d0e3675d51a3972797bcaf1047b92ee43fc04bf757e452edb2501cc6baa
SSDEEP 49152:4HSarve2wIDiFilNkzVMWzU0hdBdo+6WuDayPAr/NJJ8:4i29Dxb8h
TLSH
T162F54B41ABE8CE1BE1BF2775A4F200125BB1E449E732DB4B1694E6792C637406D0A37F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpA1A5.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpA1A5.tmp.bat
Size 153B
SHA256 b3fc526ed2ddf684288823f9157243a75a0760d7dacea0b82b3e85252f95ab79
MD5 2fc75485aea578bcaaca74244ce162b5
SHA1 f71d0439e53b841fbd33ee2048a13f57fe40da36
SHA512 a3201cac4100349339b987ffd5956da78718261a358bef1854fe639c303712b027abcc50aebf9dd97de0d5dcf9795c52a39ba882dfd84ec3813bd5ebebe113a5
TLSH
T1C6C02B4295C7EA5E1808341305FAD59DE1722C2E3F40FBB0C344800D128049EF0D9341
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4660-1-0x0000000000CB0000-0x0000000000FFA000-memory.dmp

Download

memory/4660-0-0x00007FFA0545F000-0x00007FFA05460000-memory.dmp

Download

memory/4660-2-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4660-3-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4660-4-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4660-5-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download

memory/4660-10-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp

Download