asyncrat | 6d2873e3fb2a802ab48e10d8a15e0649655af9591b6dccfa05eb57f0f553ffd8

Analysis

max time kernel
60s
max time network
61s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d2873e3fb2a802ab48e10d8a15e0649655af9591b6dccfa05eb57f0f553ffd8.exe
Size 45KB
Sample260930-ymxhcagh39
SHA256 6d2873e3fb2a802ab48e10d8a15e0649655af9591b6dccfa05eb57f0f553ffd8
MD5 afaa8a7b6f3aed02b029ffb7757e6bf5
SHA1 3470aa7d8c010f1373276d19801c9f1405bf2a57
SHA512 d52b8daf214d3b2c0fd5906ea0bf43415087cd40eb6123dde261a5b3e932db6eb303415a6cce3b0b071086ea857c59332d81ad7af0a823c624a151eae963b7ab
SSDEEP 768:lu6XdTvER+SWUk6P4mo2qbEKjPGaG6PIyzjbFgX3iQUUYHjxvGqwtBDZWx:lu6XdTv2S2RKTkDy3bCXSQYDxOdWx
TLSH
T1E5230A003BE8812BF2BE4FB8ACF26145467AF6A36603D54D1CC451D75613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

3mikk.buzz:443
3mikk.buzz:8443
3mikk.buzz:25
3mikk.buzz:80

Mutex

jJ0W2vxLLulx

Attributes

delay
3
install
true
install_file
mb66.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000d00000001c61e-10.dat	family_asyncrat

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5960	cmd.exe
3136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d2873e3fb2a802ab48e10d8a15e0649655af9591b6dccfa05eb57f0f553ffd8.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1880	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4940	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\6d2873e3fb2a802ab48e10d8a15e0649655af9591b6dccfa05eb57f0f553ffd8.exe
"C:\Users\Admin\AppData\Local\Temp\6d2873e3fb2a802ab48e10d8a15e0649655af9591b6dccfa05eb57f0f553ffd8.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3788
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "mb66" /tr '"C:\Users\Admin\AppData\Roaming\mb66.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:3136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "mb66" /tr '"C:\Users\Admin\AppData\Roaming\mb66.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6817.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  PID:5960
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1880
- - C:\Users\Admin\AppData\Roaming\mb66.exe
    "C:\Users\Admin\AppData\Roaming\mb66.exe"
    3⤵
    PID:5364

C:\Users\Admin\AppData\Roaming\mb66.exe
"C:\Users\Admin\AppData\Roaming\mb66.exe"
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp6817.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp6817.tmp.bat
Size 148B
SHA256 f4885ff29444c554e395769e0efe71f33114f04f873b558ecb9f69a3bd916afc
MD5 b2cdbd26179436e719b6cef589386871
SHA1 78b2d84e358fa961f85754cf2ffbfaa8525244f8
SHA512 5840fd46d4a6cc6ea3ff366da331ed1a6412203b6bfebf6d133dff11bd6a2ac27a5cb1b2b2d75aaa6d655085082652e42e7f8a079a520816c1cb6bf5df8c2761
TLSH
T1D9C02B4391C5EA4E3806141302FBD5ACE1726C993FC0BB00D304400D628044AF0D9341
MD5 SHA1 SHA512 TLSH

Submit Download

mb66.exe

Path C:\Users\Admin\AppData\Roaming\mb66.exe
Size 45KB
SHA256 6d2873e3fb2a802ab48e10d8a15e0649655af9591b6dccfa05eb57f0f553ffd8
MD5 afaa8a7b6f3aed02b029ffb7757e6bf5
SHA1 3470aa7d8c010f1373276d19801c9f1405bf2a57
SHA512 d52b8daf214d3b2c0fd5906ea0bf43415087cd40eb6123dde261a5b3e932db6eb303415a6cce3b0b071086ea857c59332d81ad7af0a823c624a151eae963b7ab
SSDEEP 768:lu6XdTvER+SWUk6P4mo2qbEKjPGaG6PIyzjbFgX3iQUUYHjxvGqwtBDZWx:lu6XdTv2S2RKTkDy3bCXSQYDxOdWx
TLSH
T1E5230A003BE8812BF2BE4FB8ACF26145467AF6A36603D54D1CC451D75613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-12-0x0000000074352000-0x0000000074353000-memory.dmp

Download

memory/3788-0-0x0000000074B72000-0x0000000074B73000-memory.dmp

Download

memory/3788-1-0x0000000000080000-0x0000000000092000-memory.dmp

Download

memory/3788-2-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/3788-3-0x0000000004BC0000-0x0000000004C5C000-memory.dmp

Download

memory/3788-8-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads