asyncrat | a01800943355f4b93674511624a7d29da702fafb6c250cfcc6e11fbc60a951d9

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 957KB
Sample260910-elca8sfk3y
SHA256 a01800943355f4b93674511624a7d29da702fafb6c250cfcc6e11fbc60a951d9
MD5 95a7e7662a21d7c0e589275e80f9d9f0
SHA1 347f645d6843692eb3714b77c01b8e0b2ada7ceb
SHA512 2b08ff946ad47c0a45402e985499b7fd8773540c244887997d3d04abdadea2501c21cc358b3e421be37990cd29d8468b3f2f86cdee0b59dd2c84320c4310af7c
SSDEEP 24576:TnvS+55BpfRX95rDoKWdc9Lzt7s1joEAq1sDU:rKA5/fBj0N+3CjoE/1sDU
TLSH
T10C25D019E7E405F9E0B7E578CE838912E7777C494771D68F03AC69A61F232908E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default discovery asyncrat donutloader loader persistence rat

Malware Config

Extracted

Family

asyncrat

Version

Botnet

Default

110.42.6.163:8848

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/5860-46-0x0000000004C80000-0x0000000004C9C000-memory.dmp	family_asyncrat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/5860-38-0x0000000002320000-0x000000000233C000-memory.dmp	family_donutloader

Detects executables attemping to enumerate video devices using WMI 1 IoCs

resource	yara_rule
behavioral2/memory/5860-46-0x0000000004C80000-0x0000000004C9C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Executes dropped EXE 5 IoCs

pid	Process
3116	19.exe
5860	TenioDL.exe
4340	TenioDL.exe
3032	TenioDL.exe
4200	TenioDL.exe

Loads dropped DLL 4 IoCs

pid	Process
5860	TenioDL.exe
4340	TenioDL.exe
3032	TenioDL.exe
4200	TenioDL.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\AgteeCPxa6236 = "C:\\Windows\\appcompat\\TenioDL.exe"	TenioDL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\AgteeCPxa6236 = "C:\\Program Files\\appcompat\\TenioDL.exe"	TenioDL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\AgteeCPxa6236 = "C:\\Windows\\appcompat\\TenioDL.exe"	TenioDL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\AgteeCPxa6236 = "C:\\Program Files\\appcompat\\TenioDL.exe"	TenioDL.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\appcompat\TenioDL.exe	2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Program Files\appcompat\TenioDL_core.dll	2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Program Files\appcompat\core.dat	2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\appcompat\core.dat	2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\appcompat	2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Program Files\appcompat\__tmp_rar_sfx_access_check_240769765	2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Program Files\appcompat\19.exe	2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\appcompat\19.exe	2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\appcompat\TenioDL.exe	2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\appcompat\TenioDL_core.dll	2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\appcompat\core.dat.zptmp.3116.0	19.exe
File opened for modification	C:\Windows\appcompat\core.dat	19.exe
File created	C:\Windows\appcompat\TenioDL.exe.zptmp.3116.1	19.exe
File opened for modification	C:\Windows\appcompat\TenioDL.exe	19.exe
File created	C:\Windows\appcompat\TenioDL_core.dll.zptmp.3116.2	19.exe
File opened for modification	C:\Windows\appcompat\TenioDL_core.dll	19.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TenioDL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TenioDL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TenioDL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TenioDL.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3116	3056	2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	88
PID 3116 wrote to memory of 5860	3116	19.exe	89
PID 3056 wrote to memory of 4340	3056	2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_95a7e7662a21d7c0e589275e80f9d9f0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files\appcompat\19.exe
  "C:\Program Files\appcompat\19.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\appcompat\TenioDL.exe
    C:\Windows\appcompat\TenioDL.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5860
- C:\Program Files\appcompat\TenioDL.exe
  "C:\Program Files\appcompat\TenioDL.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4340

C:\Windows\appcompat\TenioDL.exe
C:\Windows\appcompat\TenioDL.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3032

C:\Program Files\appcompat\TenioDL.exe
"C:\Program Files\appcompat\TenioDL.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

19.exe

Path C:\Program Files\appcompat\19.exe
Size 419KB
SHA256 0cab26dcf6535ab4f1ca268347b89cd3dcc069f647bb4ec5a6a1efc364429cc1
MD5 9bf53c649d00c7bfc9dbe99c7071e618
SHA1 59e245ea1f0e73902af6ed2c4ba3e85e19fa9da9
SHA512 2d3f2dd01ec98f5f68d1b97d1464e1aa7df728d479ce5d4d3996b6c452bb45e417af9932c4a5d43734be5bc0271bb236fa2bd622aeb114f7733c7171aef07b74
SSDEEP 12288:MUjnsBI+94yOqpai7Pf1aXrakRiVkiwNd+4+0XcwD:MULOx9460KUX2kRUkVC4+P+
TLSH
T1D494CF20B527C173D1899AF04A69AFF5D9B89C758FB061C777C04FA78C201C77AB5A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TenioDL.exe

Path C:\Program Files\appcompat\TenioDL.exe
Size 188KB
SHA256 fcbed331413cf92f2944d284bc52e96c08945de239bc92bcb6d2b14f4846128a
MD5 de185029f0b4d415f3072a7fb935bf44
SHA1 a20b83f92e67d8bd03d1fbb5a37fda8e9c602782
SHA512 7dbe633a352eabb644b7c78bbf9077b093ef632e2b7a6afb61d8f778331bb6151fc04b269dcd166d5ac21484a317c18ae8dbc1cd2effddb04525b97a92501e16
SSDEEP 3072:sPNJXyuj5qgencb2TFB3Q8/SQJiiElyfGgd9FxU56b5300:WXyujQgey2TFb/JeYbL
TLSH
T196147D2176D0C073D0A2247545A6C7B15E7EB872176A99CBBBC80B784F25BE1EB3530E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TenioDL_core.dll

Path C:\Windows\appcompat\TenioDL_core.dll
Size 86KB
SHA256 747e7392a25f5ca1b7e3672bc3ebf3db91a79b938ecb476f347b642a939fc981
MD5 bb4d80f99163d1e8700004c0716293fb
SHA1 ef8c35301b839340e6f5a4e3f6c2c5e932e1c4ac
SHA512 9a96ca8fd77457ec9446b8a2bf0faed6064e45eab72da025a6a5395b36c2afa7de6e60485309590f58d393ae171a78464fd6f0912a8c05e3874865d4199702c2
SSDEEP 1536:6XZ4kckAKCDUOb+n2HLsP5VUNFyHNrgQGPybQyZgvdsWDcdw79bljiJm+:OEkAqOb220VUcMQGPydqCw79bljiJm+
TLSH
T16A834A00B5D1C179D9BE18350868DA715B3EBA10DFE0DDEB3B9506AA4F302D0EE35A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

core.dat

Path C:\Windows\appcompat\core.dat
Size 108KB
SHA256 70d1e638c014e4192c226c6bf56ddd4cc2d279601fd020a622213ff1f178bb76
MD5 997c38e12d9be0687039c4cc81eab3a4
SHA1 5e553482763199aa5bef1623b697fbbc442398f4
SHA512 d54255b536003cd95ccaf463ba2dc851d11da45690cb30c52314c3a87385df2a6d77c306d5ce9e645d3d58c21c69f3a9604026e0b89f1426163fc146ddde6f8a
SSDEEP 3072:8l3uPofwpk9zzKRl5/bxu5IcEmfBy1GPZwb9MOrmXtsXKVlaz9u:8pVoGz+DUomfByIPaXraf
TLSH
T170B3022608B0665267AFDE6A3D4E26B0555D2860F6C1A19C73EFC7C38D30719F71AB48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4340-51-0x0000000005310000-0x00000000053AC000-memory.dmp

Download

memory/4340-52-0x00000000053B0000-0x000000000596A000-memory.dmp

Download

memory/4340-53-0x00000000059D0000-0x0000000005A36000-memory.dmp

Download

memory/5860-38-0x0000000002320000-0x000000000233C000-memory.dmp

Download

memory/5860-46-0x0000000004C80000-0x0000000004C9C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads