asyncrat | c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
Size 45KB
Sample260905-pl5b5ack6w
SHA256 c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333
MD5 c2e05d7558b7e6e980dd72a958cdb6b9
SHA1 c678705c0bedb6a054eb49d78e29eec2fdd6d529
SHA512 5a06b4baa623a3d4d268703f911ef47604550fc7b802e34901cbfa0aefb8ec7adc8459792d3b13f63447b49fac3ba907d138296e97afe1a3fa01fcf3ef91a629
SSDEEP 768:5udApTNctooWUS7C+mo2qtBCwyTtUPIczjbCgX3i7lovfxS86dGuP+BDZ0x:5udApTNmU22E7c3blXSBKff6TPQd0x
TLSH
T101232B003BE8812BE2BF5B78A8F26145467AF2673603D58D2CC451DB5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

gaiviet69.com:80
gaiviet69.com:22
gaiviet69.com:8080
gaiviet69.com:8880
gaiviet69.com:2052
gaiviet69.com:2082
gaiviet69.com:2086
gaiviet69.com:2095
gaiviet69.com:443
gaiviet69.com:2053
gaiviet69.com:2083
gaiviet69.com:2087
gaiviet69.com:2096
gaiviet69.com:8443
www.gaiviet69.com:80
www.gaiviet69.com:22
www.gaiviet69.com:8080
www.gaiviet69.com:8880
www.gaiviet69.com:2052
www.gaiviet69.com:2082
www.gaiviet69.com:2086
www.gaiviet69.com:2095
www.gaiviet69.com:443
www.gaiviet69.com:2053
www.gaiviet69.com:2083
www.gaiviet69.com:2087
www.gaiviet69.com:2096
www.gaiviet69.com:8443
remote.gaiviet69.com:80
remote.gaiviet69.com:22
remote.gaiviet69.com:8080
remote.gaiviet69.com:8880
remote.gaiviet69.com:2052
remote.gaiviet69.com:2082
remote.gaiviet69.com:2086
remote.gaiviet69.com:2095
remote.gaiviet69.com:443
remote.gaiviet69.com:2053
remote.gaiviet69.com:2083
remote.gaiviet69.com:2087
remote.gaiviet69.com:2096
remote.gaiviet69.com:8443
malware.gaiviet69.com:80
malware.gaiviet69.com:22
malware.gaiviet69.com:8080
malware.gaiviet69.com:8880
malware.gaiviet69.com:2052
malware.gaiviet69.com:2082
malware.gaiviet69.com:2086
malware.gaiviet69.com:2095
malware.gaiviet69.com:443
malware.gaiviet69.com:2053
malware.gaiviet69.com:2083
malware.gaiviet69.com:2087
malware.gaiviet69.com:2096
malware.gaiviet69.com:8443

Mutex

Rgzz7US9PpPL

Attributes

delay
0
install
true
install_file
2rcp72.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000d00000001c53c-10.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2676	2rcp72.exe

Outbound SSH connection to public host 2 TTPs 3 IoCs

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

command_and_control

Protocol Tunneling

T1572

Network Service Discovery

T1046

description	flow	ioc
SSH destination	10	104.21.72.80:22
SSH destination	7	104.21.72.80:22
SSH destination	8	172.67.177.137:22

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3184	cmd.exe
2312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2rcp72.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5036	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 3184	5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe	89
PID 5000 wrote to memory of 2312	5000	c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe	90
PID 3184 wrote to memory of 3716	3184	cmd.exe	93
PID 2312 wrote to memory of 5036	2312	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe
"C:\Users\Admin\AppData\Local\Temp\c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "2rcp72" /tr '"C:\Users\Admin\AppData\Roaming\2rcp72.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "2rcp72" /tr '"C:\Users\Admin\AppData\Roaming\2rcp72.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp579C.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5036
- - C:\Users\Admin\AppData\Roaming\2rcp72.exe
    "C:\Users\Admin\AppData\Roaming\2rcp72.exe"
    3⤵
    PID:1244

C:\Users\Admin\AppData\Roaming\2rcp72.exe
"C:\Users\Admin\AppData\Roaming\2rcp72.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Protocol Tunneling

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp579C.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp579C.tmp.bat
Size 150B
SHA256 8243ad8b737eda81c79eff93dd5cdb6e848b99cb40d030989e08d9b110de94d2
MD5 41232312cba216117bcbb60ec77d806f
SHA1 2f1f715ae28e207d8b001397257f4ed1d846cfc9
SHA512 de90af5185ca1e045ce023f4ed5f7dfa5db58155893656af0cd89a5b6cf249ecd3374346594352a7ea81d5c4a529ec0b5784d80d28fead52cb915e6b83619fe7
TLSH
T1A4C02B8251C5FB0F3C461C1306FADE8CA2B2AC5F3F40BF10CB44940E2280548F0E9345
MD5 SHA1 SHA512 TLSH

Submit Download

2rcp72.exe

Path C:\Users\Admin\AppData\Roaming\2rcp72.exe
Size 45KB
SHA256 c7e2e5a5239df5d73378f80955e3e834159fbae21bd73fb4a58cf092141e7333
MD5 c2e05d7558b7e6e980dd72a958cdb6b9
SHA1 c678705c0bedb6a054eb49d78e29eec2fdd6d529
SHA512 5a06b4baa623a3d4d268703f911ef47604550fc7b802e34901cbfa0aefb8ec7adc8459792d3b13f63447b49fac3ba907d138296e97afe1a3fa01fcf3ef91a629
SSDEEP 768:5udApTNctooWUS7C+mo2qtBCwyTtUPIczjbCgX3i7lovfxS86dGuP+BDZ0x:5udApTNmU22E7c3blXSBKff6TPQd0x
TLSH
T101232B003BE8812BE2BF5B78A8F26145467AF2673603D58D2CC451DB5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2676-12-0x00000000746F0000-0x0000000074EAC000-memory.dmp

Download

memory/2676-14-0x00000000746F0000-0x0000000074EAC000-memory.dmp

Download

memory/5000-0-0x00000000748C2000-0x00000000748C3000-memory.dmp

Download

memory/5000-1-0x0000000000500000-0x0000000000512000-memory.dmp

Download

memory/5000-2-0x00000000748B0000-0x000000007506C000-memory.dmp

Download

memory/5000-3-0x0000000004F10000-0x0000000004FAC000-memory.dmp

Download

memory/5000-8-0x00000000748B0000-0x000000007506C000-memory.dmp

Download