asyncrat | 5d4df40d02211eef02fee33af165a77d0cee76d98ecf28f1538ec38fa26b6eec

Analysis

max time kernel
58s
max time network
18s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d4df40d02211eef02fee33af165a77d0cee76d98ecf28f1538ec38fa26b6eec.exe
Size 56KB
Sample261102-yfmdsscy61
SHA256 5d4df40d02211eef02fee33af165a77d0cee76d98ecf28f1538ec38fa26b6eec
MD5 80e3e282081da309c7909ddac092c1fb
SHA1 5079158cf6aa1c44c06c9952f15338aa87fcdd44
SHA512 dc08cc9f6cb0963f7780cf099a62b067137ebcace47c75fce9f411737a3dd2b640e21872e886141a78859a296bbdc152706f9361e5f617ea24b28d4d42295e6b
SSDEEP 1536:p+Tydj7EwPrbcXfCKVmV8u0kejNUHLi/:ITy28rbcKKVmf0kINX/
TLSH
T1CD435B043BE8812BF2BE4B7999F211448BB9F2672103DA9D1CD051DB5A13FC5DA436FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default discovery asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

c168qr.com:443
c168qr.com:8848
c168qr.com:8080

Mutex

tnItZRPvsahz

Attributes

delay
3
install
true
install_file
ActiveWindow.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2444	2296	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d4df40d02211eef02fee33af165a77d0cee76d98ecf28f1538ec38fa26b6eec.exe

C:\Users\Admin\AppData\Local\Temp\5d4df40d02211eef02fee33af165a77d0cee76d98ecf28f1538ec38fa26b6eec.exe
"C:\Users\Admin\AppData\Local\Temp\5d4df40d02211eef02fee33af165a77d0cee76d98ecf28f1538ec38fa26b6eec.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 800
  2⤵
  - Program crash
  PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2296 -ip 2296
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-0-0x00000000748A2000-0x00000000748A3000-memory.dmp

Download

memory/2296-1-0x0000000000CB0000-0x0000000000CC4000-memory.dmp