asyncrat | 780002bbf553b2f525f0072729c421b49fe3ff23ee998334abb311ea814aa80b

Analysis

max time kernel
60s
max time network
61s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
780002bbf553b2f525f0072729c421b49fe3ff23ee998334abb311ea814aa80b.exe
Size 56KB
Sample261029-ymrxvsev4t
SHA256 780002bbf553b2f525f0072729c421b49fe3ff23ee998334abb311ea814aa80b
MD5 9346a42ee4004f82ae1c8fae0c96ba80
SHA1 9d7e4b2f4fda346dcf9630dd44ffce6b026ae8f8
SHA512 a252764a059f61a5fa90b934c0222223a27edd67e03c48dfe8974abf014ee0563b660c76c297a1caef3cd5fc0d367f9a95bcc41a20f3c14243262b74733e010a
SSDEEP 1536:y3/eZv2b8DG5/jF3bLXS7kVmVS/kejNUHLy/:2/PjF3bLskVmEkINH/
TLSH
T184434C003BE9912BF27D4A78A9F1214547B9F2637603EA9C2CC511DB5613FC6CA426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mb66-01.com:443
mb66-01.com:8848
mb66-01.com:8080

Mutex

tnItZRPvsahz

Attributes

delay
3
install
true
install_file
googlecloud.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0003000000000439-10.dat	family_asyncrat

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2304	cmd.exe
996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	780002bbf553b2f525f0072729c421b49fe3ff23ee998334abb311ea814aa80b.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5416	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5596	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\780002bbf553b2f525f0072729c421b49fe3ff23ee998334abb311ea814aa80b.exe
"C:\Users\Admin\AppData\Local\Temp\780002bbf553b2f525f0072729c421b49fe3ff23ee998334abb311ea814aa80b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "googlecloud" /tr '"C:\Users\Admin\AppData\Roaming\googlecloud.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:2304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "googlecloud" /tr '"C:\Users\Admin\AppData\Roaming\googlecloud.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4FDB.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  PID:996
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:5416
- - C:\Users\Admin\AppData\Roaming\googlecloud.exe
    "C:\Users\Admin\AppData\Roaming\googlecloud.exe"
    3⤵
    PID:6112

C:\Users\Admin\AppData\Roaming\googlecloud.exe
"C:\Users\Admin\AppData\Roaming\googlecloud.exe"
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4FDB.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4FDB.tmp.bat
Size 155B
SHA256 9a29fec83d28c59ad268f2374b990bd362a7dde5d2705af7899adc6a6f05476a
MD5 4ab8169e3a3bf7a5f6eb800324a4d163
SHA1 b70070831cf756ea09743987d4b5a57e10499b87
SHA512 ce4887f0ec0dfee866eb29a05c7bc00eba96255679cbd474f7143b3d8a53caca1224a566674ff26e4c89695c336fbe4038e4c4c62030389c969c55f2f80bc45e
TLSH
T14CC02B8361C9EB0F3E07A8A303FAD69C92736C1A3F40BB10D384404E528044AF4D93C1
MD5 SHA1 SHA512 TLSH

Submit Download

googlecloud.exe

Path C:\Users\Admin\AppData\Roaming\googlecloud.exe
Size 56KB
SHA256 780002bbf553b2f525f0072729c421b49fe3ff23ee998334abb311ea814aa80b
MD5 9346a42ee4004f82ae1c8fae0c96ba80
SHA1 9d7e4b2f4fda346dcf9630dd44ffce6b026ae8f8
SHA512 a252764a059f61a5fa90b934c0222223a27edd67e03c48dfe8974abf014ee0563b660c76c297a1caef3cd5fc0d367f9a95bcc41a20f3c14243262b74733e010a
SSDEEP 1536:y3/eZv2b8DG5/jF3bLXS7kVmVS/kejNUHLy/:2/PjF3bLskVmEkINH/
TLSH
T184434C003BE9912BF27D4A78A9F1214547B9F2637603EA9C2CC511DB5613FC6CA426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1504-0-0x00000000745C2000-0x00000000745C3000-memory.dmp

Download

memory/1504-1-0x0000000000B00000-0x0000000000B14000-memory.dmp

Download

memory/1504-2-0x00000000745B0000-0x0000000074D6C000-memory.dmp

Download

memory/1504-3-0x0000000005610000-0x00000000056AC000-memory.dmp

Download

memory/1504-9-0x00000000745B0000-0x0000000074D6C000-memory.dmp

Download

memory/1872-12-0x00000000745A0000-0x0000000074D5C000-memory.dmp

Download

memory/1872-14-0x00000000745A0000-0x0000000074D5C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads