asyncrat | d018a74363e5e2667f51319c7ff5244ef14ac17aca77afc9062ffb5fef60128c

Analysis

max time kernel
60s
max time network
59s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d018a74363e5e2667f51319c7ff5244ef14ac17aca77afc9062ffb5fef60128c.exe
Size 56KB
Sample261024-ya2arsdx4n
SHA256 d018a74363e5e2667f51319c7ff5244ef14ac17aca77afc9062ffb5fef60128c
MD5 18508e944d658d0c7dd8b0aa114cfdb3
SHA1 76bb10e380a75b97c47d3f9dc8ed5c97fe14c288
SHA512 293719e5faa6d7f1118f0fc5f261c482ee824de822d23dd30e6fdcb5b72a7c70e8434063b12727299674c054bf81ad88c9f3b229430da49cd283569b016e8f9d
SSDEEP 1536:Cuf09TH2w240lVJj+bSXSbhI+fNdRkejNUHLTq:CufoTH2w2FTj+bSYhDlvkINmq
TLSH
T157435C0037E9812BF2BE4F78ADF21144867AF2676603E55D2CC451DB5A13FC6CA426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

h99.online:443
h99.online:8848
h99.online:8080

Mutex

kBVPjakHQ19X

Attributes

delay
3
install
true
install_file
AsyncRat.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0006000000000442-10.dat	family_asyncrat

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5020	cmd.exe
2884	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d018a74363e5e2667f51319c7ff5244ef14ac17aca77afc9062ffb5fef60128c.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4904	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4312	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\d018a74363e5e2667f51319c7ff5244ef14ac17aca77afc9062ffb5fef60128c.exe
"C:\Users\Admin\AppData\Local\Temp\d018a74363e5e2667f51319c7ff5244ef14ac17aca77afc9062ffb5fef60128c.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AsyncRat" /tr '"C:\Users\Admin\AppData\Roaming\AsyncRat.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:5020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "AsyncRat" /tr '"C:\Users\Admin\AppData\Roaming\AsyncRat.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3639.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  PID:2884
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4904
- - C:\Users\Admin\AppData\Roaming\AsyncRat.exe
    "C:\Users\Admin\AppData\Roaming\AsyncRat.exe"
    3⤵
    PID:4276

C:\Users\Admin\AppData\Roaming\AsyncRat.exe
"C:\Users\Admin\AppData\Roaming\AsyncRat.exe"
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp3639.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp3639.tmp.bat
Size 152B
SHA256 c219550d87d25dd4f328a5568d45482c65bd29b098a17d4110769fec8eddaa91
MD5 404712cc2b70c7249e10d0358ce12d36
SHA1 7839f2cd9e1a1cc2106c9ddd142a43062a015546
SHA512 94004b6626623c444e925cc4bef0adafd7d659a09ac6045c6ddfef311a930fb447d98f5f16b5c794ee6aa61964f4fd3fe4bfbc17d971ddafa28a7271137d500b
TLSH
T16BC08C4292C6AA1E2C05341312BAA88C956A6C593E40AB40C30844A92280949E0E9245
MD5 SHA1 SHA512 TLSH

Submit Download

AsyncRat.exe

Path C:\Users\Admin\AppData\Roaming\AsyncRat.exe
Size 56KB
SHA256 d018a74363e5e2667f51319c7ff5244ef14ac17aca77afc9062ffb5fef60128c
MD5 18508e944d658d0c7dd8b0aa114cfdb3
SHA1 76bb10e380a75b97c47d3f9dc8ed5c97fe14c288
SHA512 293719e5faa6d7f1118f0fc5f261c482ee824de822d23dd30e6fdcb5b72a7c70e8434063b12727299674c054bf81ad88c9f3b229430da49cd283569b016e8f9d
SSDEEP 1536:Cuf09TH2w240lVJj+bSXSbhI+fNdRkejNUHLTq:CufoTH2w2FTj+bSYhDlvkINmq
TLSH
T157435C0037E9812BF2BE4F78ADF21144867AF2676603E55D2CC451DB5A13FC6CA426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2080-0-0x0000000074292000-0x0000000074293000-memory.dmp

Download

memory/2080-1-0x00000000001E0000-0x00000000001F4000-memory.dmp

Download

memory/2080-2-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/2080-3-0x0000000004C10000-0x0000000004CAC000-memory.dmp

Download

memory/2080-8-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/4816-12-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/4816-14-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads