asyncrat | d8cc7dd63e430c3edcc9c32f8323f0bee84aafaf54e232df29b12334a4bfb5f4

Analysis

max time kernel
58s
max time network
55s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d8cc7dd63e430c3edcc9c32f8323f0bee84aafaf54e232df29b12334a4bfb5f4.exe
Size 112KB
Sample260910-ymsjdsvgnc
SHA256 d8cc7dd63e430c3edcc9c32f8323f0bee84aafaf54e232df29b12334a4bfb5f4
MD5 473de1a7589c33f47340dd21483fc4b7
SHA1 ba89b0a9960edf091704d905f1e3ab98d09376dd
SHA512 6a65b5b74695acb2cfbe3977ebdf75d65e564c27dfec0b303a2c08781fa5f07bfd3937d759af7e41698ab0135df03d3759f24ac90daafc65b9927e37b576bdac
SSDEEP 1536:7uQSNT8572xs91qQbCXSucQmSHd2tKrqi35RwbO:7uQWT8572C91qQbC/LFlPwbO
TLSH
T1AEB39F30EFD7B03AED6D4AFC5CA371714926A5D3250EF57AFCC0319B06226C1A5326A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

ok99.fun:443
ok99.fun:80
www.ok99.fun:443
www.ok99.fun:80

Mutex

6sZUHhREgNF8

Attributes

delay
3
install
true
install_file
ChromeUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001100000001c528-10.dat	family_asyncrat

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4696	cmd.exe
2080	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8cc7dd63e430c3edcc9c32f8323f0bee84aafaf54e232df29b12334a4bfb5f4.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4156	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4620	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\d8cc7dd63e430c3edcc9c32f8323f0bee84aafaf54e232df29b12334a4bfb5f4.exe
"C:\Users\Admin\AppData\Local\Temp\d8cc7dd63e430c3edcc9c32f8323f0bee84aafaf54e232df29b12334a4bfb5f4.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ChromeUpdate" /tr '"C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:4696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "ChromeUpdate" /tr '"C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9E0B.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  PID:2080
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4156
- - C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
    "C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
    3⤵
    PID:4112

C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
"C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp9E0B.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp9E0B.tmp.bat
Size 156B
SHA256 fc15a3a57368c78475ec3a4bd5e72d8099c86de548201070eceb782d08dd801d
MD5 162d868d5822c443be33822f98435910
SHA1 82244cff95ed74282f20546e4ae4e97f1fb27d83
SHA512 41813565ba04ded73f5f69d9d774a6b25573f1c9a214f57ee5e0f031783325d52bd708105a2b92254d13307804ecb7ac64aadd0879f3a2f7f88b85bc5fdf855c
TLSH
T173C02B4351C5EE1E2D05641302FAD4CC99B36C5A3F48FF00C344440E7280C48F8DD382
MD5 SHA1 SHA512 TLSH

Submit Download

ChromeUpdate.exe

Path C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
Size 112KB
SHA256 d8cc7dd63e430c3edcc9c32f8323f0bee84aafaf54e232df29b12334a4bfb5f4
MD5 473de1a7589c33f47340dd21483fc4b7
SHA1 ba89b0a9960edf091704d905f1e3ab98d09376dd
SHA512 6a65b5b74695acb2cfbe3977ebdf75d65e564c27dfec0b303a2c08781fa5f07bfd3937d759af7e41698ab0135df03d3759f24ac90daafc65b9927e37b576bdac
SSDEEP 1536:7uQSNT8572xs91qQbCXSucQmSHd2tKrqi35RwbO:7uQWT8572C91qQbC/LFlPwbO
TLSH
T1AEB39F30EFD7B03AED6D4AFC5CA371714926A5D3250EF57AFCC0319B06226C1A5326A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3832-12-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/3832-14-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/6004-0-0x00000000747E2000-0x00000000747E3000-memory.dmp

Download

memory/6004-1-0x00000000003D0000-0x00000000003F2000-memory.dmp

Download

memory/6004-2-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/6004-3-0x0000000004F60000-0x0000000004FFC000-memory.dmp

Download

memory/6004-8-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads