asyncrat | 26728b524fb3116a7c136e5d16db05620abd0ee145ff3227d98f6d3ac6f23f34

Analysis

max time kernel
298s
max time network
170s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ricevuta della transazione.vbs
Size 222KB
Sample260919-tpde2ayt2p
SHA256 26728b524fb3116a7c136e5d16db05620abd0ee145ff3227d98f6d3ac6f23f34
MD5 e36708638aec8108e20dac83f44df49e
SHA1 07204a449fc0398b6bbde1f37bfd3aa27b72dc55
SHA512 d95819a103926022125b660fe090f38bc6f5debdd7b2c917521343acdc0f56a7a604f259071a8daa43cf3a1fc4595b610b5107f0d4772717a3aca54dbbc3e110
SSDEEP 3072:NW3+acPuJd7Bbtnj8E96DfKio0SrBHT/2qtG+/bH03WOaR0IGXYJ9yNAh8cp+6YL:Nc+aNP7nnQ58plHPtT/bHwWPNisy6YBR
TLSH
T1E924F131A89960233177EABFDDE9CE0A1D12BCAB7080646971DF74849FDFA4132A51F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

64.89.160.29:5566

Mutex

NvbzswGT7pdS

Attributes

delay
3
install
true
install_file
chill.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3812	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3864	chill.exe
4888	chill.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4816	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3812 set thread context of 1256	3812	powershell.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2532	cmd.exe
2488	cmd.exe
5844	cmd.exe
2064	cmd.exe
4108	cmd.exe
2016	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chill.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4896	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1404	schtasks.exe
4640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3812	powershell.exe
3812	powershell.exe
3812	powershell.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe
1256	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeDebugPrivilege	1256	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2016	4816	WScript.exe	91
PID 4816 wrote to memory of 3812	4816	WScript.exe	93
PID 4816 wrote to memory of 2532	4816	WScript.exe	95
PID 4816 wrote to memory of 2488	4816	WScript.exe	97
PID 4816 wrote to memory of 5844	4816	WScript.exe	99
PID 5844 wrote to memory of 1404	5844	cmd.exe	101
PID 4816 wrote to memory of 4596	4816	WScript.exe	102
PID 3812 wrote to memory of 1256	3812	powershell.exe	106
PID 3812 wrote to memory of 1256	3812	powershell.exe	106
PID 3812 wrote to memory of 1256	3812	powershell.exe	106
PID 3812 wrote to memory of 1256	3812	powershell.exe	106
PID 3812 wrote to memory of 1256	3812	powershell.exe	106
PID 1256 wrote to memory of 2064	1256	MSBuild.exe	107
PID 1256 wrote to memory of 4108	1256	MSBuild.exe	109
PID 2064 wrote to memory of 4640	2064	cmd.exe	111
PID 4108 wrote to memory of 4896	4108	cmd.exe	112
PID 4108 wrote to memory of 4888	4108	cmd.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ricevuta della transazione.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist "C:\Users\Admin\AppData\Local\Temp\dep90552" mkdir "C:\Users\Admin\AppData\Local\Temp\dep90552"
  2⤵
  - Executes a command shell one-liner
  PID:2016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& 'C:\Users\Admin\AppData\Local\Temp\ld67070.ps1'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chill" /tr '"C:\Users\Admin\AppData\Roaming\chill.exe"' & exit
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2064
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "chill" /tr '"C:\Users\Admin\AppData\Roaming\chill.exe"'
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEDC6.tmp.bat""
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4896
    - - C:\Users\Admin\AppData\Roaming\chill.exe
        
        "C:\Users\Admin\AppData\Roaming\chill.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist "C:\Users\Admin\AppData\Local\Photo Studio" mkdir "C:\Users\Admin\AppData\Local\Photo Studio"
  2⤵
  - Executes a command shell one-liner
  PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist "C:\Users\Admin\AppData\Local\Photo Studio\PhotoStudio.vbs" copy /y "C:\Users\Admin\AppData\Local\Temp\Ricevuta della transazione.vbs" "C:\Users\Admin\AppData\Local\Photo Studio\PhotoStudio.vbs"
  2⤵
  - Executes a command shell one-liner
  PID:2488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks.exe /create /tn "PhotoStudioVBS" /xml "C:\Users\Admin\AppData\Local\Temp\tk88419.xml" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "PhotoStudioVBS" /xml "C:\Users\Admin\AppData\Local\Temp\tk88419.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\tk88419.xml"
  2⤵
  PID:4596

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:336

C:\Users\Admin\AppData\Roaming\chill.exe
"C:\Users\Admin\AppData\Roaming\chill.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ld67070.ps1

Path C:\Users\Admin\AppData\Local\Temp\ld67070.ps1
Size 2KB
SHA256 25fbd83dab9509e3ad4f0ccc86f83646bbbc0febc2ce9f0dffae68be39925bc5
MD5 f694b3359c0fe6e6d9b1aa8a3c37b2e6
SHA1 70cfc275d4ad0f488453a021f7d49e3792ea1a5d
SHA512 c7f664cf2adc344cee905df7e84eca74acfbbc082a556c0f0e3228c90a39043538a27fb2410fbbf48be30b74ff415c03422d834627a656967beeb8bfc985c040
TLSH
T1D941314193B979BD4C8CA4A380E507BC92B4C09F2EB59A0FBBE1D0480C5676CAF8A116
MD5 SHA1 SHA512 TLSH

Submit Download

pf99129.dat

Path C:\Users\Admin\AppData\Local\Temp\pf99129.dat
Size 6KB
SHA256 b956c3b90ec5a5d8cc3d959abef4c7a3498c1676444f396cc03530b080fb4f52
MD5 bef3e38af2f6c2aa8425709722872605
SHA1 fa7305a41f76824300586d11619c24a7818e7ebc
SHA512 cb70902a67690771d146575558c762bf11068667e987aa53c927b5bffed6089e63f14e35973ab3f2aa775df12a6000c38858ecd6f1a017fc8bb5bb792c853de1
SSDEEP 96:UIscP1YAqDvsyzle8RF934eLSit0+EsFZetrS3FIpaCW+ofZuKyV2wl6nOdn:U+YnDXeQfnWItFkrYFzChofZu32wr
TLSH
T15AD1AEF85A4E3CA6504AA785F12F8C8F0CA032ADCBD4788B978BC41C9425BD83102BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rf79306.dat

Path C:\Users\Admin\AppData\Local\Temp\rf79306.dat
Size 179KB
SHA256 f425ea9b044b3e8fea1daef3a451f62f7313dd73eee8a629f5fffd2cdb129323
MD5 6b39966c86a7e18484e9925311c949da
SHA1 6d870f535a44648638aa3b65f5c2dc100962e33a
SHA512 7148d087823e1c9248611659ed3822cad40343c3f8c6ff271c84207b42fad6244a1adc9a925d14b57cc7ca6f336de0405a95cce012c058ce10c0deee6c6c8787
SSDEEP 3072:4qKGtvTtiCew0Y6rKNpab39WT/2qhraeHHg37+nRcISXAJKJma40xsSRX1B49:RvtRirr88NWPheeHHE7sEEJMRXfU
TLSH
T1E10412154A75922225F92C7A2EED8D8F24C1F4CD4490DDE9B3E3B8452727F0932972DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk88419.xml

Path C:\Users\Admin\AppData\Local\Temp\tk88419.xml
Size 1KB
SHA256 87c0bc272b7801ee4c7711f5b2dba8afa42b759d8b0becaedc21fce4e5cb5765
MD5 4ad47e0a9d033a31bcbf5b09962f2003
SHA1 c7a6b87c66da984d7f7422043913e5d46024c7cf
SHA512 17e7a00cdd65c7526328ce810945a348e7ce4b21c28e74b9f62406aa26aed30cbe5031aedabd77bbe1a7a4e8ee3fd8a246c2b82206764e829e3e105e1e1f082a
TLSH
T115318C43A7FD220DF1F39F9CAAB654125ABAFD655C28D4AD00B40A0D0971A71C9B0B37
MD5 SHA1 SHA512 TLSH

Submit Download

tmpEDC6.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpEDC6.tmp.bat
Size 149B
SHA256 0f48bf50de6d14b5a46742778f9a36d6fed186ce28e4b63cec0c999fbddb373a
MD5 8eebe439d632c555942626dca14a8027
SHA1 a9cbecd3d7936837e9e92416350bc0a26adc5dce
SHA512 926273977730216d2737bd5690d0f7a85ea69f9a166b5c60dbf52e0e1da8e11787a66fe086f0442883d9557ed707e1cf8b2b942a5263d91c6847002640e66c68
TLSH
T1CBC02B4291C7EA8E3846145312FAD49C91B3AC1E3F44FB80C304444E52C084CF0DB381
MD5 SHA1 SHA512 TLSH

Submit Download

chill.exe

Path C:\Users\Admin\AppData\Roaming\chill.exe
Size 249KB
SHA256 151d0125c20cdde578d02de3f2a56eb904870a887bb7f1c59bf61471da231916
MD5 f8e68d6abe411ce0c71d6b8c1c1b9048
SHA1 77360aa532c299f636f424a2866016ee6bd5c09b
SHA512 3e6c59395c8c5f07d39db829aa335420ffe426fb9a4ab831cfe1273e803afd5f91912ee341e01b4e108b298349bdeea9e7e52874b05fa1723ebc408be896b650
SSDEEP 3072:6DEKKwBWmSEoRooC7GvORoQYiY35e8w2XpFU4rwOe+ZbZEFf02RFivFuv4GuhK:UHK2W0u1tvORstRXfM102bicw4
TLSH
T103446A01A7EC4615F6FF1A78B8B015158B76F867E866E35E388C61AC1F73740EA60363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1256-31-0x0000000004D20000-0x0000000004DBC000-memory.dmp

Download

memory/1256-28-0x00000000003D0000-0x00000000003E2000-memory.dmp

Download

memory/3812-20-0x0000000006ED0000-0x0000000006F66000-memory.dmp

Download

memory/3812-10-0x0000000002CF0000-0x0000000002D12000-memory.dmp

Download

memory/3812-16-0x0000000005340000-0x000000000535E000-memory.dmp

Download

memory/3812-17-0x0000000005D70000-0x0000000005DBC000-memory.dmp

Download

memory/3812-12-0x0000000005050000-0x00000000050B6000-memory.dmp

Download

memory/3812-11-0x0000000004FE0000-0x0000000005046000-memory.dmp

Download

memory/3812-4-0x0000000074AB2000-0x0000000074AB3000-memory.dmp

Download

memory/3812-21-0x0000000006280000-0x000000000629A000-memory.dmp

Download

memory/3812-22-0x00000000062E0000-0x0000000006302000-memory.dmp

Download

memory/3812-23-0x0000000007530000-0x0000000007AEA000-memory.dmp

Download

memory/3812-24-0x0000000008170000-0x00000000087EC000-memory.dmp

Download

memory/3812-15-0x0000000005A10000-0x0000000005D6B000-memory.dmp

Download

memory/3812-26-0x00000000071D0000-0x00000000071EA000-memory.dmp

Download

memory/3812-27-0x0000000007200000-0x0000000007208000-memory.dmp

Download

memory/3812-9-0x0000000074AA0000-0x000000007525C000-memory.dmp

Download

memory/3812-30-0x0000000074AA0000-0x000000007525C000-memory.dmp

Download

memory/3812-8-0x00000000053C0000-0x0000000005A0A000-memory.dmp

Download

memory/3812-7-0x0000000074AA0000-0x000000007525C000-memory.dmp

Download

memory/3812-5-0x00000000024D0000-0x0000000002506000-memory.dmp

Download

memory/3864-39-0x0000000000C00000-0x0000000000C40000-memory.dmp

Download

memory/3864-40-0x0000000002F60000-0x0000000002F7A000-memory.dmp

Download

memory/3864-41-0x00000000057C0000-0x000000000591A000-memory.dmp

Download