Overview

overview

10

Static

static

3

369c60f636...c1.exe

windows10-2004-x64

10

369c60f636...c1.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    67s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 19:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    369c60f636fd6e80399fa18f03dc9bad79f0cd01e3f4027a48a9411ef2be1ec1.exe
  • Size 47.9MB
  • Sample260925-ynyrsshc73
  • SHA256 369c60f636fd6e80399fa18f03dc9bad79f0cd01e3f4027a48a9411ef2be1ec1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
nulldefense_evasionexecutionasyncratpersistencerat

Malware Config

Extracted

Family

  • asyncrat

Version

  • 0.5.6A

Botnet

  • null

C2

  • sam144169-56334.portmap.io:56334

  • sam144169-56334.portmap.io:5552

  • sam144169-56334.portmap.io:5050

  • webforma.chickenkiller.com:56334

  • webforma.chickenkiller.com:5552

  • webforma.chickenkiller.com:5050

  • webdata.ddns.net:56334

  • webdata.ddns.net:5552

  • webdata.ddns.net:5050

Mutex

  • xOUgFqeTTggB

Attributes
  • delay

    5

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution

Processes

  • C:\Users\Admin\AppData\Local\Temp\369c60f636fd6e80399fa18f03dc9bad79f0cd01e3f4027a48a9411ef2be1ec1.exe
    "C:\Users\Admin\AppData\Local\Temp\369c60f636fd6e80399fa18f03dc9bad79f0cd01e3f4027a48a9411ef2be1ec1.exe"
    1⤵
      PID:2524
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'svchost"' /tr "'C:\Users\Admin\AppData\Roaming\svchost.exe"'
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4628
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA36A.tmp.bat""
        2⤵
        • Executes a command shell one-liner
        PID:4352
        • C:\Windows\system32\timeout.exe
          timeout 3
          3⤵
          • Delays execution with timeout.exe
          PID:2692
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          3⤵
            PID:6096

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            tmpA36A.tmp.bat
            • Path C:\Users\Admin\AppData\Local\Temp\tmpA36A.tmp.bat
            • Size 151B
            • SHA256 47782fd27e5be71fd9ca7734b620134011b6c21f3378ac9a7f1579d3aa6dd263
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2524-0-0x00007FFB152EF000-0x00007FFB152F0000-memory.dmp
            Download

            memory/2524-1-0x0000000000EE0000-0x0000000000EF2000-memory.dmp
            Download

            memory/2524-2-0x00007FFB15160000-0x00007FFB15B04000-memory.dmp
            Download

            memory/2524-3-0x00007FFB15160000-0x00007FFB15B04000-memory.dmp
            Download

            memory/2524-4-0x00007FFB15160000-0x00007FFB15B04000-memory.dmp
            Download

            memory/2524-9-0x00007FFB15160000-0x00007FFB15B04000-memory.dmp
            Download