asyncrat | 42b186ad874e56ff431011ed7caf2adf0b1b5cfdcf8fb34ea0586a37f1de453c

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO2606-00023.bat
Size 859KB
Sample260928-dthmjss18n
SHA256 42b186ad874e56ff431011ed7caf2adf0b1b5cfdcf8fb34ea0586a37f1de453c
MD5 9621f97ffbf06fea841236e496ff2e21
SHA1 d24b9aeaca188460a4ef5f3f482806e26b5a34e2
SHA512 86c5943cb256e254e965cd63f88d71c4d83b8cdfd8634b6d82e747a6dd1023cc51b05ac043b63397811eff84634316ac2518c2fae8cd4a540060b77c60326c4d
SSDEEP 24576:FNoyxEfADUcNY9/L75gyUYOiUJv/nLmNlcce/v8Gc:nM8Nu3ga57
TLSH
T15915121FDA9B058F162140AD7B027EE4F189827F2F3227F5026CB5D821E9DB0BD5265E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat donutloader loader rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

lg.sonqhong.com:80
lg.sonqhong.com:443
lg.sonqhong.com:8080

Mutex

8KlUBhFQHvym

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs

Network activity triggered a Suricata alert

suricata asyncrat

flow	pid	Process
4	1320	support.exe
4	1320	support.exe

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1320-16-0x0000000007B80000-0x0000000007B92000-memory.dmp	family_asyncrat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/1320-15-0x0000000003F10000-0x0000000003F23000-memory.dmp	family_donutloader

Executes dropped EXE 1 IoCs

pid	Process
1320	support.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4380	certutil.exe
2936	certutil.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2160	cscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2980	cmd.exe
4948	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	support.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	support.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	support.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	support.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1320	support.exe
1320	support.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1320	support.exe
1320	support.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2160	2980	cmd.exe	90
PID 2160 wrote to memory of 4948	2160	cscript.exe	91
PID 4948 wrote to memory of 4380	4948	cmd.exe	93
PID 4948 wrote to memory of 3576	4948	cmd.exe	94
PID 4948 wrote to memory of 5244	4948	cmd.exe	95
PID 4948 wrote to memory of 2936	4948	cmd.exe	96
PID 4948 wrote to memory of 1320	4948	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO2606-00023.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\system32\cscript.exe
  cscript.exe //nologo "C:\Users\Admin\AppData\Local\Temp\~run.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\PO2606-00023.bat" hidden
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\system32\certutil.exe
      certutil -decode "C:\Users\Admin\AppData\Local\Temp\temp2.txt" "C:\Users\Admin\AppData\Local\Temp\app.zip"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:4380
  - - C:\Windows\system32\where.exe
      where tar
      4⤵
      PID:3576
  - - C:\Windows\system32\tar.exe
      tar -xf "C:\Users\Admin\AppData\Local\Temp\app.zip" -C "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:5244
  - - C:\Windows\system32\certutil.exe
      certutil -decode "C:\Users\Admin\AppData\Local\Temp\temp1.txt" "C:\Users\Admin\AppData\Local\Temp\au.ini"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\support.exe
      "C:\Users\Admin\AppData\Local\Temp\support.exe" "C:\Users\Admin\AppData\Local\Temp\au.dat"
      4⤵
      Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.zip

Path C:\Users\Admin\AppData\Local\Temp\app.zip
Size 493KB
SHA256 3aedd8f658ef06a99aeac848d8ce39dad858d15ba287a01a3ef75b78e39bda7a
MD5 26a3ea0e9830a02545411d1fca77e062
SHA1 45cf09155ed7da5001cfc50c45468b28518987e4
SHA512 1449ff2c9cc3a0a67c1461ee7584b5b42a46a9d07239fa08db13fa8b776505f88d60b8564c8c7ca59865bd0d428525855e9d5a1a692399df19737efdcd7b4556
SSDEEP 12288:4EGO0sMpgY0MdHCu6KijspCNW9EzTKtuoLgisc+R:4EGO0rrdq9E/ulc+R
TLSH
T1E9B423B3B22D7AE72A825CD9EC6DC0273BDCF660E3916911C3B7D11856B34D99C1E422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

au.dat

Path C:\Users\Admin\AppData\Local\Temp\au.dat
Size 1KB
SHA256 5b30788069a293dc8786239d1174041a41dee447bb7ff114cd2fc58963e71b62
MD5 808bd175d8d080bd2ce829310869c780
SHA1 4ca77cedff0cee59d15a356165367f8fc061c2ae
SHA512 5b450744d20b3c850cf5a5bd0c112bc16c798c80b8296598fe0b1c8160d923afe80c5b3c3af8ca13a6c7d8c02d0cee638af24645efe987773d5f63d79be70c21
TLSH
T1D0219CAC2A8B8F57105ED0689513C99BB4608C2C423F1A4A3DF5C764383D27EE9682AD
MD5 SHA1 SHA512 TLSH

Submit Download

au.ini

Path C:\Users\Admin\AppData\Local\Temp\au.ini
Size 75KB
SHA256 c19c1f178f01f8547fa64f492bdafff627f5eb6c94e19bc4e56ecfc512797324
MD5 b327eecd15d7b2be68cc539f79a63e96
SHA1 fcdcc8539638acee30d98d3e73a0b84b7737ff3a
SHA512 a1cacd577a64a8c5b12f476c2d340dcf669be6001256273a68a17eedaa7c6df55cf74f807d328cdc81bec2af55858d415a8e05ed8c84951da82045488ee8e2d8
SSDEEP 1536:ZnDGiSvYrvUqUOZPLOik8Xy4iUv2+IYpXhYJMylmEdZy54JU604qwYX:ZDGiSvYrvUq7ZPL9NiU9YE0Zq4J+wYX
TLSH
T1DB73025176B4170A827B915872BC0B0BC544E30EC9128BDBF1ED6B36761377DBA1D2CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

support.exe

Path C:\Users\Admin\AppData\Local\Temp\support.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp1.txt

Path C:\Users\Admin\AppData\Local\Temp\temp1.txt
Size 103KB
SHA256 596991bf99b38973c0a2b049f15ad19588a5292fec5c3d0c5a3f818b13a74ac5
MD5 dd423e4056690a81bab535f7310cbce8
SHA1 5d47cf8c16bb4c0a7a25fc6bf9416e5767e91198
SHA512 37b1e5658187c148d429c4e845b4a59b61796d6bb9c8d00c027b59e2ae6c850b5f4fca098e490d7f5481243c2f795009a3c8873c2e102296b99c29af4fb2f61a
SSDEEP 3072:BQxS0jtmPT6DXa377g3TefwdNqg89ZVJeVder:exZ07JLITeYdQVLveVder
TLSH
T1AAA3E179771E04492B3192ED2BA2B8B4604C82C978925BB93F7C9EE073DD415BC764C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp2.txt

Path C:\Users\Admin\AppData\Local\Temp\temp2.txt
Size 678KB
SHA256 1d045ade5d2e27452b5c22e5ec1ab33ee65f73e76b2e61091f5d5794eac0c97e
MD5 56107d17a850aa3255524982b2888760
SHA1 be06fdd4729c8cb05e91f0ec863044b0b689edc8
SHA512 0a4d8d03519602560d52ac3f3326bf4090e1eb2468757e29cf5d111405b9ad390bf694ae238d441755e6ce9ab677c17a0c9555a3de0b825d1c0adc5da5f8eb56
SSDEEP 12288:etc2MLDlOtcj5Y9/L7C9cXNgddicTDYOzhCVUJv9FnQsfmvFlceAfU4me/v8Gcv:KADUcNY9/L75gyUYOiUJv/nLmNlcce/A
TLSH
T1A8E4238CC6EFA3E84E1750F9FA04E446B5D96353590217B243BC832479A46F4DEB3CA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~run.vbs

Path C:\Users\Admin\AppData\Local\Temp\~run.vbs
Size 117B
SHA256 76c427547617b41b2e0c6c079afdbce118901a44ef58839c618f75eac8e484b0
MD5 0b9db83a4d8516dcb92b1fb40796565b
SHA1 9d102b00f1c171f0b2b62878b335177f83207439
SHA512 118418ae3d7bfad173d9c75dcbf0abb2fd7da18ffd985d46d5e3b957a2823feb44bb47b4ad55cc06f5279ef6f385c3ce56c9e339e4d0691921653131bddc90b3
TLSH
T1CEB01216E5DDD63D0116C1A74539E50CC8E5DC882B61BB0E4F10C80C61B78D5A6AF696
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1320-15-0x0000000003F10000-0x0000000003F23000-memory.dmp

Download

memory/1320-16-0x0000000007B80000-0x0000000007B92000-memory.dmp

Download

memory/1320-17-0x0000000008220000-0x00000000082BC000-memory.dmp

Download

memory/1320-18-0x0000000008880000-0x0000000008E3A000-memory.dmp

Download

memory/1320-19-0x0000000008330000-0x0000000008396000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads