asyncrat | f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526

Analysis

max time kernel
147s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

time.exe
Size

6.6MB
MD5

10927dbe47f47c1f4260bf4723ed0912
SHA1

0ed62e76ca8d7e9e7ba514d5ed9aa24ddaf4f22d
SHA256

f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526
SHA512

ecb833ffbb4dd8ec25ff5e39a8ce6c4d0c36dcd02873ebc0fbfcf561ad1270db6dde600ea429800c538eaa9adae10cc1f8c45d4f469a59d1123b203e3a8867f9
SSDEEP

98304:CCj8xgBfao1hZlzb71QGQCPDbZfxz87le5BLoHLSLgj8NnJwFDDEy2nZsBJ1nCkS:jjhaofdQmRKuErSEEJwdFvZnCkK

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

todfg.duckdns.org:6745

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
updateee.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5052 created 3460	5052	time.exe	56

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/940-36-0x0000026009000000-0x0000026009012000-memory.dmp	family_asyncrat

Loads dropped DLL 4 IoCs

pid	Process
5052	time.exe
5052	time.exe
5052	time.exe
5052	time.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5052	time.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5052	time.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 5052	5068	time.exe	83
PID 5068 wrote to memory of 5052	5068	time.exe	83
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85
PID 5052 wrote to memory of 940	5052	time.exe	85

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3460
- C:\Users\Admin\AppData\Local\Temp\time.exe
  "C:\Users\Admin\AppData\Local\Temp\time.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Users\Admin\AppData\Local\Temp\time.exe
    "C:\Users\Admin\AppData\Local\Temp\time.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5052
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI50682\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_bz2.pyd

Filesize
81KB

MD5
10d42efac304861ad19821b4594fa959

SHA1
1a65f60bba991bc7e9322af1e19f193dae76d77a

SHA256
8eecdcc250637652e6babc306ea6b8820e9e835ddd2434816d0e0fd0ca67fd14

SHA512
3f16dba627a133586e9d1c16d383b9461424d31892278ab984f7e6932a1cdc51445e1bec017a665bd66c0f2a9ba417387fecc5fdede36d67f8343b82a2ceb9ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_ctypes.pyd

Filesize
120KB

MD5
df6be515e183a0e4dbe9cdda17836664

SHA1
a5e8796189631c1aaca6b1c40bc5a23eb20b85db

SHA256
af598ae52ddc6869f24d36a483b77988385a5bbbf4618b2e2630d89d10a107ee

SHA512
b3f23530de7386cc4dcf6ad39141240e56d36322e3d4041e40d69d80dd529d1f8ef5f65b55cdca9641e378603b5252acfe5d50f39f0c6032fd4c307f73ef9253

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_decimal.pyd

Filesize
245KB

MD5
a1ffc2a156e9266932c351a88e5e7fab

SHA1
ebfc901c28035264fbb5b0f30e68ab3b45410d13

SHA256
b8409829dc4fde70f38754de55d3090a1cd52c78ffece2a08572a58de3af294d

SHA512
74fecaac362deff5139ea8553142ba7e8a7740b757a06edf16cf4a9320a20e7a1567380bfe2f40a3b7e8508f9715efedf27c6c23d2b2fb3ed7664cb81f6d58d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_hashlib.pyd

Filesize
62KB

MD5
f419ac6e11b4138eea1fe8c86689076a

SHA1
886cda33fa3a4c232caa0fa048a08380971e8939

SHA256
441d32922122e59f75a728cc818f8e50613866a6c3dec627098e6cc6c53624e2

SHA512
6b5aa5f5fbc00fb48f49b441801ee3f3214bd07382444569f089efb02a93ce907f6f4e0df281bda81c80f2d6a247b0adc7c2384a2e484bc7ef43b43c84756d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_lzma.pyd

Filesize
153KB

MD5
3230404a7191c6228a8772d3610e49e5

SHA1
4e8e36c89b4ff440ddff9a5b084b262c9b2394ec

SHA256
33ae42f744d2688bb7d5519f32ff7b7489b96f4eea47f66d2009dba6a0023903

SHA512
6ecce0c8e8b3d42275d486e8ff495e81e36adaaacaaa3db37844e204fcdaa6d89cb3d81c43d9e16d938cd8b6671b8800fe74a1e723a9187b0566a8f3c39d5d5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50682\_socket.pyd

Filesize
76KB

MD5
0fc65ec300553d8070e6b44b9b23b8c0

SHA1
f8db6af578cf417cfcddb2ed798c571c1abd878f

SHA256
360744663fce8dec252abbda1168f470244fdb6da5740bb7ab3171e19106e63c

SHA512
cba375a815db973b4e8babda951d1a4ca90a976e9806e9a62520a0729937d25de8e600e79a7a638d77df7f47001d8f884e88ee4497bd1e05c1dae6fa67fb3dd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50682\base_library.zip

Filesize
1.4MB

MD5
9dc12ea9f7821873da74c772abb280f0

SHA1
3f271c9f54bc7740b95eaa20debbd156ebd50760

SHA256
c5ec59385bfac2a0ac38abf1377360cd1fddd05c31f8a8b4e44252e0e63acb10

SHA512
a3175c170bbb28c199ab74ad3116e71f03f124d448bf0e9dd4afcacdc08a7a52284cf858cfd7e72d35bd1e68c6ba0c2a1a0025199aeb671777977ea53e1f2535

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50682\libcrypto-1_1.dll

Filesize
3.3MB

MD5
6f4b8eb45a965372156086201207c81f

SHA1
8278f9539463f0a45009287f0516098cb7a15406

SHA256
976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

SHA512
2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50682\libffi-8.dll

Filesize
37KB

MD5
d86a9d75380fab7640bb950aeb05e50e

SHA1
1c61aaf9022cd1f09a959f7b2a65fb1372d187d7

SHA256
68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b

SHA512
18437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50682\python311.dll

Filesize
5.5MB

MD5
a72993488cecd88b3e19487d646f88f6

SHA1
5d359f4121e0be04a483f9ad1d8203ffc958f9a0

SHA256
aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038

SHA512
c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50682\select.pyd

Filesize
28KB

MD5
116335ebc419dd5224dd9a4f2a765467

SHA1
482ef3d79bfd6b6b737f8d546cd9f1812bd1663d

SHA256
813eede996fc08e1c9a6d45aaa4cbae1e82e781d69885680a358b4d818cfc0d4

SHA512
41dc7facab0757ed1e286ae8e41122e09738733ad110c2918f5e2120dfb0dbff0daefcad2bffd1715b15b44c861b1dd7fb0d514983db50ddc758f47c1b9b3bf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50682\unicodedata.pyd

Filesize
1.1MB

MD5
cdb5f373d24adceb4dc4fa1677757f0c

SHA1
af6b381eed65d244c57129346008ec8532ba336b

SHA256
175c4cb528f1ac4e285c575cc3f5e85ec4b3ae88860210b5d795b580c7f0b5d9

SHA512
429a326648c761bf068ca7735094644f532d631cf9355c9f1a5743a5791837a36cd6aa2efe2265c7541feb06310d0c07b634dd04438d8eddbdf1c4147938a868

Download Submit
memory/940-33-0x00000260074C0000-0x00000260074D2000-memory.dmp

Filesize
72KB

Download
memory/940-35-0x00007FFAD0EF3000-0x00007FFAD0EF5000-memory.dmp

Filesize
8KB

Download
memory/940-36-0x0000026009000000-0x0000026009012000-memory.dmp

Filesize
72KB

Download
memory/940-37-0x00007FFAD0EF0000-0x00007FFAD19B1000-memory.dmp

Filesize
10.8MB

Download
memory/940-38-0x00007FFAD0EF3000-0x00007FFAD0EF5000-memory.dmp

Filesize
8KB

Download
memory/940-39-0x00007FFAD0EF0000-0x00007FFAD19B1000-memory.dmp

Filesize
10.8MB

Download
memory/940-40-0x00007FFAD0EF0000-0x00007FFAD19B1000-memory.dmp

Filesize
10.8MB

Download
memory/940-41-0x00007FFAD0EF0000-0x00007FFAD19B1000-memory.dmp

Filesize
10.8MB

Download
memory/5052-32-0x0000017F40A90000-0x0000017F40AE6000-memory.dmp

Filesize
344KB

Download
memory/5052-31-0x0000017F407F0000-0x0000017F409F0000-memory.dmp

Filesize
2.0MB

Download
memory/5052-34-0x0000017F40A90000-0x0000017F40AE6000-memory.dmp

Filesize
344KB

Download