asyncrat | 9a9061c8169f773bc2b1316c30d7f0fe1bc38c2117ce60c1cb632674faaea34d

Analysis

max time kernel
58s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a9061c8169f773bc2b1316c30d7f0fe1bc38c2117ce60c1cb632674faaea34d.exe
Size 68KB
Sample261110-ycrjcaae26
SHA256 9a9061c8169f773bc2b1316c30d7f0fe1bc38c2117ce60c1cb632674faaea34d
MD5 db2277a3d4b98ead864645afaae5115d
SHA1 290697bd354ea4917736cdeb9771595ae200a6ba
SHA512 09cbb9ed5ea8983af41392b5f95019c18dcf60ffedc7c2cea0f4f710b329b165110520e355412ed75dcfa4fe27592d7a2058bfc77460cdc1145ff078c96f7387
SSDEEP 1536:KREhEHUljW3CyfQ++YtEbb2wlHVGnDpqKmY7:KfUljMIstEbb2oggz
TLSH
T129634A0037ACC925F5BE8AB4ADE2954146BAD5772202D64E3CC410CB6B9FFC649127FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery asyncrat rat

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	9a9061c8169f773bc2b1316c30d7f0fe1bc38c2117ce60c1cb632674faaea34d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	9a9061c8169f773bc2b1316c30d7f0fe1bc38c2117ce60c1cb632674faaea34d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	9a9061c8169f773bc2b1316c30d7f0fe1bc38c2117ce60c1cb632674faaea34d.exe

C:\Users\Admin\AppData\Local\Temp\9a9061c8169f773bc2b1316c30d7f0fe1bc38c2117ce60c1cb632674faaea34d.exe
"C:\Users\Admin\AppData\Local\Temp\9a9061c8169f773bc2b1316c30d7f0fe1bc38c2117ce60c1cb632674faaea34d.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tmp8AF5.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp8AF5.tmp
Size 1KB
SHA256 74eba079b36c835cd89af395cf53272c53351cd851efb140a8152410c4e2973e
MD5 6ce85262afbc028314bdf6fe9aa718a5
SHA1 b59fe71c2ebd80df9e3ba5681ff6e36c90c2f0a8
SHA512 8ac1198de48c3acab03482958ccd5044561599373338f0bb9ff203c0d596b810143d420ebdcb20abd60a1383a08e70f7ddac6fa9b304a0a3a61aa06af030e6fb
TLSH
T124310B294CBA8439B1F3D5E40B4C444F5A64DA10A7B096BB20B721D81F316057C95771
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3192-0-0x00000000009C0000-0x00000000009D6000-memory.dmp

Download

memory/3192-1-0x0000000002C00000-0x0000000002C10000-memory.dmp