asyncrat | 9109d9bd117f540aed9afa6f293c1396cc18ed979056eadca97c69e3f957c14d

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
132.exe
Size 181KB
Sample260830-3qpn5abl6x
SHA256 9109d9bd117f540aed9afa6f293c1396cc18ed979056eadca97c69e3f957c14d
MD5 c97653e9ca2411da555ff27871e6f06f
SHA1 70eea44815946dec239d4a4f374107f6bc72b7fa
SHA512 716e2bed1263826b6bee1c5a625f138ebf5314bfa8786313136a28165fe28263f633ec2707c8e32a64ad78485791d5050eefcb9ed6bbe8d08b352919e571cc3b
SSDEEP 1536:uFML87TRk+XhtIrQtkaofCCB8BkVbvKmYGkEohAwWtBUySJ6zWtjI6/YHv:2kehtKQZWCBBkV+mYGdK8z40fP
TLSH
T1BA04D00AE107DC51DD3A52B350DAC57A6590B918C731AF0FA609C624730BE32BB76B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat donutloader loader persistence rat

Malware Config

Extracted

Family

asyncrat

Version

BwRat 1.0.0

Botnet

Default

112.213.103.58:5812

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2648-1-0x0000000003370000-0x0000000003386000-memory.dmp	family_asyncrat
behavioral2/memory/3272-5-0x0000000002D50000-0x0000000002D66000-memory.dmp	family_asyncrat

Detects DonutLoader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/2648-0-0x00000000005A0000-0x00000000005D3000-memory.dmp	family_donutloader
behavioral2/memory/3272-4-0x00000000005A0000-0x00000000005D3000-memory.dmp	family_donutloader

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\132.exe"	132.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	132.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\132.exe"	132.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	132.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\132.exe"	132.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\132.exe"	132.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\132.exe"	132.exe

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2132	cmd.exe
2188	cmd.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2840	sc.exe
4852	sc.exe
4984	sc.exe
3820	sc.exe
3116	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5636	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1800	2648	WerFault.exe	87
4960	3272	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5572	schtasks.exe
2812	schtasks.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2648	132.exe
Token: SeSecurityPrivilege	2648	132.exe
Token: SeTakeOwnershipPrivilege	2648	132.exe
Token: SeLoadDriverPrivilege	2648	132.exe
Token: SeSystemProfilePrivilege	2648	132.exe
Token: SeSystemtimePrivilege	2648	132.exe
Token: SeProfSingleProcessPrivilege	2648	132.exe
Token: SeIncBasePriorityPrivilege	2648	132.exe
Token: SeCreatePagefilePrivilege	2648	132.exe
Token: SeBackupPrivilege	2648	132.exe
Token: SeRestorePrivilege	2648	132.exe
Token: SeShutdownPrivilege	2648	132.exe
Token: SeDebugPrivilege	2648	132.exe
Token: SeSystemEnvironmentPrivilege	2648	132.exe
Token: SeRemoteShutdownPrivilege	2648	132.exe
Token: SeUndockPrivilege	2648	132.exe
Token: SeManageVolumePrivilege	2648	132.exe
Token: 33	2648	132.exe
Token: 34	2648	132.exe
Token: 35	2648	132.exe
Token: 36	2648	132.exe
Token: SeIncreaseQuotaPrivilege	3272	132.exe
Token: SeSecurityPrivilege	3272	132.exe
Token: SeTakeOwnershipPrivilege	3272	132.exe
Token: SeLoadDriverPrivilege	3272	132.exe
Token: SeSystemProfilePrivilege	3272	132.exe
Token: SeSystemtimePrivilege	3272	132.exe
Token: SeProfSingleProcessPrivilege	3272	132.exe
Token: SeIncBasePriorityPrivilege	3272	132.exe
Token: SeCreatePagefilePrivilege	3272	132.exe
Token: SeBackupPrivilege	3272	132.exe
Token: SeRestorePrivilege	3272	132.exe
Token: SeShutdownPrivilege	3272	132.exe
Token: SeDebugPrivilege	3272	132.exe
Token: SeSystemEnvironmentPrivilege	3272	132.exe
Token: SeRemoteShutdownPrivilege	3272	132.exe
Token: SeUndockPrivilege	3272	132.exe
Token: SeManageVolumePrivilege	3272	132.exe
Token: 33	3272	132.exe
Token: 34	3272	132.exe
Token: 35	3272	132.exe
Token: 36	3272	132.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2188	2648	132.exe	89
PID 2648 wrote to memory of 2132	2648	132.exe	90
PID 2648 wrote to memory of 5636	2648	132.exe	91
PID 2188 wrote to memory of 1540	2188	cmd.exe	95
PID 2132 wrote to memory of 1484	2132	cmd.exe	96
PID 5636 wrote to memory of 3820	5636	cmd.exe	97
PID 2188 wrote to memory of 5572	2188	cmd.exe	99
PID 5636 wrote to memory of 3116	5636	cmd.exe	100
PID 2132 wrote to memory of 2812	2132	cmd.exe	101
PID 5636 wrote to memory of 2840	5636	cmd.exe	103
PID 5636 wrote to memory of 4852	5636	cmd.exe	104
PID 5636 wrote to memory of 4984	5636	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\132.exe
"C:\Users\Admin\AppData\Local\Temp\132.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /delete /tn WinUpdate /f 2>nul & schtasks /create /tn WinUpdate /tr "C:\Users\Admin\AppData\Local\Temp\132.exe" /sc onlogon /delay 0000:30 /f /ru SYSTEM /rl highest
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn WinUpdate /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn WinUpdate /tr "C:\Users\Admin\AppData\Local\Temp\132.exe" /sc onlogon /delay 0000:30 /f /ru SYSTEM /rl highest
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /delete /tn WinDefend /f 2>nul & schtasks /create /tn WinDefend /tr "C:\Users\Admin\AppData\Local\Temp\132.exe" /sc hourly /mo 1 /f /ru SYSTEM /rl highest
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn WinDefend /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn WinDefend /tr "C:\Users\Admin\AppData\Local\Temp\132.exe" /sc hourly /mo 1 /f /ru SYSTEM /rl highest
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc stop WinDefend 2>nul & sc delete WinDefend 2>nul & sc create WinDefend binPath= "C:\Users\Admin\AppData\Local\Temp\132.exe" start= auto error= restart & sc failure WinDefend reset= 86400 actions= restart/30000/restart/60000/restart/120000 & sc start WinDefend
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5636
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3820
- - C:\Windows\SysWOW64\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3116
- - C:\Windows\SysWOW64\sc.exe
    sc create WinDefend binPath= "C:\Users\Admin\AppData\Local\Temp\132.exe" start= auto error= restart
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2840
- - C:\Windows\SysWOW64\sc.exe
    sc failure WinDefend reset= 86400 actions= restart/30000/restart/60000/restart/120000
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4852
- - C:\Windows\SysWOW64\sc.exe
    sc start WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 1168
  2⤵
  - Program crash
  PID:1800

C:\Users\Admin\AppData\Local\Temp\132.exe
C:\Users\Admin\AppData\Local\Temp\132.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 1244
  2⤵
  - Program crash
  PID:4960