asyncrat | 91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/09/2026, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
118.exe
Size 423KB
Sample260904-nsffxawvbw
SHA256 91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561
MD5 0d60097c07241a4a98fb18196d21d75f
SHA1 32eb1eb04ffdce6012e24467778552999cf7f011
SHA512 27ca6f4c4f390acb6c9e2002f03cd20d7a4fb4fa0de2f79f2e26a977508f185da5888096da2ab784e78b420c0734c54a7a0f50201d69a09df16144d76601f916
SSDEEP 12288:DyWZpwVcYJYkYJ+UmoaQi2oAkpDZAUqYk9nhDXvU:DyWZpDiAxad2oAk36nBhDXvU
TLSH
T146942306FA31C57AE2B20174DDB56D3B4EBE8533866A3D43479074997E614C2D71F382
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution asyncrat donutloader loader persistence privilege_escalation rat

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4148-13-0x00000275F9470000-0x00000275F948A000-memory.dmp	family_asyncrat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4148-11-0x00000275F8EF0000-0x00000275F8F0C000-memory.dmp	family_donutloader

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Active Setup\Installed Components\{B4E5F6A1-2C3D-4E5F-9A8B-1C2D3E4F5A6B}	11.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Active Setup\Installed Components\{B4E5F6A1-2C3D-4E5F-9A8B-1C2D3E4F5A6B}\StubPath = "\"C:\\Users\\Public\\Documents\\res\\msword.exe\""	11.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Active Setup\Installed Components\{B4E5F6A1-2C3D-4E5F-9A8B-1C2D3E4F5A6B}\Version = "1,0,0,2"	11.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Active Setup\Installed Components\{B4E5F6A1-2C3D-4E5F-9A8B-1C2D3E4F5A6B}	msword.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Active Setup\Installed Components\{B4E5F6A1-2C3D-4E5F-9A8B-1C2D3E4F5A6B}\StubPath = "\"C:\\Users\\Public\\Documents\\res\\msword.exe\""	msword.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Active Setup\Installed Components\{B4E5F6A1-2C3D-4E5F-9A8B-1C2D3E4F5A6B}\Version = "1,0,0,2"	msword.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.exe	11.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.exe	11.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.exe	msword.exe

Executes dropped EXE 2 IoCs

pid	Process
4148	11.exe
1040	msword.exe

Loads dropped DLL 2 IoCs

pid	Process
4148	11.exe
1040	msword.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2508	cmd.exe
3100	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	118.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4776	schtasks.exe
4064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4148	11.exe
4148	11.exe
4148	11.exe
4148	11.exe
4148	11.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	11.exe
Token: SeDebugPrivilege	1040	msword.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4148	11.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5920 wrote to memory of 4148	5920	118.exe	89
PID 4148 wrote to memory of 2508	4148	11.exe	91
PID 2508 wrote to memory of 4064	2508	cmd.exe	93
PID 1040 wrote to memory of 3100	1040	msword.exe	96
PID 3100 wrote to memory of 4776	3100	cmd.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\118.exe
"C:\Users\Admin\AppData\Local\Temp\118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Users\Public\Documents\11.exe
  "C:\Users\Public\Documents\11.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c schtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4064

C:\Users\Public\Documents\res\msword.exe
"C:\Users\Public\Documents\res\msword.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cat_client_diag.log

Path C:\Users\Admin\AppData\Local\Temp\cat_client_diag.log
Size 138B
SHA256 0fd284ce99ffeca40afd779cb94dfcb160568729ebcb3a497bc6a60e733c5862
MD5 1aeb42fc872d1663e3625d9837a2756b
SHA1 2227c7863f8fa8db12b4ff30c932495e53bceaf5
SHA512 baeff6f9b6ab1fc7e03b007b09e9cb6fda0533c52d2902a2b24dfbe1497381d1ea7414dbb698aa35571008ff6a68569b105f478f867a003087995282bc792210
TLSH
T13CC04C3571C91279EB56D34C86655442D5C060322615B858125C6EBA559208B1D7CE28
MD5 SHA1 SHA512 TLSH

Submit Download

cat_client_diag.log

Path C:\Users\Admin\AppData\Local\Temp\cat_client_diag.log
Size 353B
SHA256 1e528ae56322bcfe510e266e025e5033edb02df4ed62fb4ab1bc17737a89dd2f
MD5 0f673443866a856e96e35237fc3f9ef8
SHA1 f64adff53c7fb7bcf3fbe19d59049c8140c2bdd1
SHA512 0bbd9ded5bb7d0b6cca8f9f0e865c8ae6901e0382f03bb826e7605df6dc4969ddfd5725dd96fd6b627385f2439bd487b8b727494054e9257bbc309eb5b1b5fea
TLSH
T15DE0482E61C402BDE20B7344CADD1593C9C160312714BC7C361E6EE57B5388B5DACD64
MD5 SHA1 SHA512 TLSH

Submit Download

cat_client_diag.log

Path C:\Users\Admin\AppData\Local\Temp\cat_client_diag.log
Size 953B
SHA256 40a52cebbfc8ca55eb7064a524bff1998ab9c9432c8832cda57eef33325899c0
MD5 73adda7b293bf19e14e3e23364fe968f
SHA1 3ef879c26771ef21aed3193bb32790903e42e6fd
SHA512 e2127a593f11f2bfeee2c59077159491086489e2721f911fa046be448341a8d9e00ef2c02b5d2fe20f471e6f2f681d149ca009092705496c1c7e336198e94aae
TLSH
T1F3112B1EA0C802FDA2172240DAED55A3EDC0A0B127049D686726ADE57B674C77E6DC60
MD5 SHA1 SHA512 TLSH

Submit Download

cat_client_diag.log

Path C:\Users\Admin\AppData\Local\Temp\cat_client_diag.log
Size 1KB
SHA256 1d6016d2ba4288b62aaac1cc8f3ad9c55d2f6fc96de2e7d85e31df5caa510750
MD5 0a3c916332014ffd0c03daf8610ba9af
SHA1 4054bf0be44caccac993c7ea794740ebd80196cb
SHA512 30986834f81a668011734eebf479c48a0da81797192a7c32b31af94936c6fd0918e58caf3b110419eded7892bd28797675d2c24b6fb2df2db3bbd7c18f0455ab
TLSH
T149212B1EA0C402FDA2172240DADD46A3EEC0A0B127049D6C7726AED57B634C77E6DC60
MD5 SHA1 SHA512 TLSH

Submit Download

cat_client_diag.log

Path C:\Users\Admin\AppData\Local\Temp\cat_client_diag.log
Size 1KB
SHA256 092f801cc3729b2249a895cc716df11dba6c5a439d60a7ad7c9251686d6d3e19
MD5 876161f0e05046edc618997e57a4794b
SHA1 cda769ef8ae316826d4a01a25c94108984319022
SHA512 0eb7fddfb70702feb824dbf261b7466376537788423a81ad5c7e003dcd6b68fe69fe5ecbf95f7faacea6a30d1a5038dfc1d8e7cc1cef02bcfa0e31d2755c58d4
TLSH
T1AA31301EB0D401ED62172280DADD86A3FEC0907227549D6CA736ADD57B574CB7F6DC20
MD5 SHA1 SHA512 TLSH

Submit Download

cat_client_diag.log

Path C:\Users\Admin\AppData\Local\Temp\cat_client_diag.log
Size 1KB
SHA256 2d7597653a8a36f744b178d1e5f6f123afcef1a52e621383a160302aeef828ba
MD5 0228a8644f669997d89fe6877ce8dc00
SHA1 38feda09a78d6e01ee85b4eab1f988b438ebb320
SHA512 8d4f99aa7e3c7a81af10dc39462601e07faaf5839daec0727ae35a3c904e20a6494086dd60bcbb78ea533ac9502e8da6a7bb35b1ec539a286ea143e32154d5bc
TLSH
T12C310F1EB0D401ED61172280DADD86A3EEC0906227549D6CA736ADD57B674CB7F6DC20
MD5 SHA1 SHA512 TLSH

Submit Download

DataLogs.conf

Path C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
Size 8B
SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
MD5 cf759e4c5f14fe3eec41b87ed756cea8
SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
MD5 SHA1 SHA512

Submit Download

11.exe

Path C:\Users\Public\Documents\11.exe
Size 202KB
SHA256 db413d7a7f36a922d30489d4df22d8fecd4da3a6e08f0a227ca770d6afa24bc3
MD5 075d1d7228143a189f71ef74f4bcb6a5
SHA1 44ae02db647ee02c3242467e87dd0cf8fe1de03d
SHA512 85e5ab1652ac6517e3c90cc83ff4a6295c87423197b182d767f2847631a53c9e094641be8205251b17943c2d7ec4a33fa91ca226287937ecfa20f7b221c80173
SSDEEP 3072:6ThKSbXiYQ41atgn29xocjz9+XtVXxMSmAxTeKamfIVjzc+v7hMDP98NYHeG:6VKSbXiYNUgn29xoy9mfIVc+v7huqU
TLSH
T17C14A25767E830C9F5B36A785AB142519B7ABCB26B34C7DF1194806E0F63BD09D30B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgeng.dll

Path C:\Users\Public\Documents\dbgeng.dll
Size 452KB
SHA256 53abcbd55948172502618a66218a7d68ea986106e084cd07bd4c9321d58689f7
MD5 61b25e84079ba06aa146415cbbb49203
SHA1 8064c75f805fb79789518be8202e1ec96d042617
SHA512 acc03783acc5c9f74940d9fcdf5ad0e5ca3d568fd51cc9c522445454df9df1eb4b7dc7ee383ad28d673a131c5d85f26e0ea82c2cd8d7e248f801687c31b568de
SSDEEP 6144:csvle2kMPBAZiJKgjknthlgyisJW0VxzNEyp2X3:csvhknVFisjVQ3
TLSH
T151A45B7432D090F5F09BD8344A1355C6E9667C9283F1EADB53D09E6A1F2B29C1AFB342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

png.dat

Path C:\Users\Public\Documents\png.dat
Size 110KB
SHA256 33ab95f004aec7e6c5024ca79d63e416eff15a2626485a481be265de45eaa0f4
MD5 a58958e3e19296add1e6262098144d53
SHA1 2ddf68297dd25cb78ab693ebc99a948be892a4a5
SHA512 0fdf2a541d1b375f94f99e58be0d3a670f8e0e18929e2beb2bbd1456e99d1e7ce303eecf10b2ca171fdf9470b34526b35d30436a42310c135cb70b0d9d683c8c
SSDEEP 3072:SZAjf4qdOCWo+qPwRPN4hmQebz7OWVOcZYd5LPXvT5:SZAL4qYTo9wNWhmQUz72ccxPXvF
TLSH
T139B31226E837CF68D1805E269F8BA0268C2462FFE4B07F1FD7E524225ABED105717953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4148-19-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/4148-18-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/4148-13-0x00000275F9470000-0x00000275F948A000-memory.dmp

Download

memory/4148-12-0x00007FFD1D88F000-0x00007FFD1D890000-memory.dmp

Download

memory/4148-11-0x00000275F8EF0000-0x00000275F8F0C000-memory.dmp

Download

memory/4148-8-0x00000275F7530000-0x00000275F7531000-memory.dmp

Download

memory/4148-14-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/4148-55-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/4148-56-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/4148-57-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download