asyncrat | 18b06619330da1b4614558f3df0e6e8008516b6392093f2a8a7768e58a90aef2

Analysis

max time kernel
40s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f8bet11h.online.exe
Size 56KB
Sample261102-s3bb6ads8l
SHA256 18b06619330da1b4614558f3df0e6e8008516b6392093f2a8a7768e58a90aef2
MD5 464ade2631721103523b84f606ebe135
SHA1 efa8f9462e8c57852e1cde8749fe26fec3ff9aa8
SHA512 1c8fabdeeadff4ce9e11adaeb89cffbe031da57e8daf05dcfc5d92b5a07ea8922e786cc754da7708c85d01c9c85fb5c4cea0cb9924de13ae054bc3c0dcfb8f31
SSDEEP 1536:erdhcPCmdXESfrbRXSKhVmVLykejNUHLi/:6d2ESfrbRNhVmAkINX/
TLSH
T1DF435C003BE8912BF67E4B78A9F221444679F2673603E99D2CD050DB5613FC6DA436ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default discovery asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

f8bet11h.online:443
f8bet11h.online:8848
f8bet11h.online:8080

Mutex

tnItZRPvsahz

Attributes

delay
3
install
true
install_file
GoogleChrome.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3628	3344	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8bet11h.online.exe

C:\Users\Admin\AppData\Local\Temp\f8bet11h.online.exe
"C:\Users\Admin\AppData\Local\Temp\f8bet11h.online.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 812
  2⤵
  - Program crash
  PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3344 -ip 3344
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3344-0-0x0000000074622000-0x0000000074623000-memory.dmp

Download

memory/3344-1-0x0000000000930000-0x0000000000944000-memory.dmp