asyncrat | ab8c7950c7cf1c5d5f0f1953f725e50cc882b41dc3c934554cc03ce79b52ffce

Analysis

max time kernel
287s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kam.exe
Size

6.6MB
MD5

a6e278e8a725750c14090f222a034bf8
SHA1

e4e25334525147214ed5c83fe3c6e06f9e72981d
SHA256

ab8c7950c7cf1c5d5f0f1953f725e50cc882b41dc3c934554cc03ce79b52ffce
SHA512

f13b8c2da7b7191177b367fa4850a5c2e1b2b43137bfce0795977bb1c0139ac6ca1f8b6ecfc7ded323a86c831d1e3e2533a35ee86e0ff3bb8bc2d740b080674e
SSDEEP

98304:pCO86/jo1hZlzb71QGQCPDbZfxz87le5BLoHLSLgj8NnJwFDDEy2nZsBJ1nCkKQg:MODLofdQmRKuErSEEJwdFvZnCkK

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

anachyyyyy.duckdns.org:7878

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4556 created 3456	4556	kam.exe	56

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/316-36-0x000001847D8D0000-0x000001847D8E6000-memory.dmp	family_asyncrat

Loads dropped DLL 4 IoCs

pid	Process
4556	kam.exe
4556	kam.exe
4556	kam.exe
4556	kam.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4556	kam.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4556	kam.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	316	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 4556	1472	kam.exe	82
PID 1472 wrote to memory of 4556	1472	kam.exe	82
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83
PID 4556 wrote to memory of 316	4556	kam.exe	83

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3456
- C:\Users\Admin\AppData\Local\Temp\kam.exe
  "C:\Users\Admin\AppData\Local\Temp\kam.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Users\Admin\AppData\Local\Temp\kam.exe
    "C:\Users\Admin\AppData\Local\Temp\kam.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4556
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI14722\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14722\_bz2.pyd

Filesize
81KB

MD5
10d42efac304861ad19821b4594fa959

SHA1
1a65f60bba991bc7e9322af1e19f193dae76d77a

SHA256
8eecdcc250637652e6babc306ea6b8820e9e835ddd2434816d0e0fd0ca67fd14

SHA512
3f16dba627a133586e9d1c16d383b9461424d31892278ab984f7e6932a1cdc51445e1bec017a665bd66c0f2a9ba417387fecc5fdede36d67f8343b82a2ceb9ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14722\_ctypes.pyd

Filesize
120KB

MD5
df6be515e183a0e4dbe9cdda17836664

SHA1
a5e8796189631c1aaca6b1c40bc5a23eb20b85db

SHA256
af598ae52ddc6869f24d36a483b77988385a5bbbf4618b2e2630d89d10a107ee

SHA512
b3f23530de7386cc4dcf6ad39141240e56d36322e3d4041e40d69d80dd529d1f8ef5f65b55cdca9641e378603b5252acfe5d50f39f0c6032fd4c307f73ef9253

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14722\_decimal.pyd

Filesize
245KB

MD5
a1ffc2a156e9266932c351a88e5e7fab

SHA1
ebfc901c28035264fbb5b0f30e68ab3b45410d13

SHA256
b8409829dc4fde70f38754de55d3090a1cd52c78ffece2a08572a58de3af294d

SHA512
74fecaac362deff5139ea8553142ba7e8a7740b757a06edf16cf4a9320a20e7a1567380bfe2f40a3b7e8508f9715efedf27c6c23d2b2fb3ed7664cb81f6d58d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14722\_hashlib.pyd

Filesize
62KB

MD5
f419ac6e11b4138eea1fe8c86689076a

SHA1
886cda33fa3a4c232caa0fa048a08380971e8939

SHA256
441d32922122e59f75a728cc818f8e50613866a6c3dec627098e6cc6c53624e2

SHA512
6b5aa5f5fbc00fb48f49b441801ee3f3214bd07382444569f089efb02a93ce907f6f4e0df281bda81c80f2d6a247b0adc7c2384a2e484bc7ef43b43c84756d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14722\_lzma.pyd

Filesize
153KB

MD5
3230404a7191c6228a8772d3610e49e5

SHA1
4e8e36c89b4ff440ddff9a5b084b262c9b2394ec

SHA256
33ae42f744d2688bb7d5519f32ff7b7489b96f4eea47f66d2009dba6a0023903

SHA512
6ecce0c8e8b3d42275d486e8ff495e81e36adaaacaaa3db37844e204fcdaa6d89cb3d81c43d9e16d938cd8b6671b8800fe74a1e723a9187b0566a8f3c39d5d5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14722\_socket.pyd

Filesize
76KB

MD5
0fc65ec300553d8070e6b44b9b23b8c0

SHA1
f8db6af578cf417cfcddb2ed798c571c1abd878f

SHA256
360744663fce8dec252abbda1168f470244fdb6da5740bb7ab3171e19106e63c

SHA512
cba375a815db973b4e8babda951d1a4ca90a976e9806e9a62520a0729937d25de8e600e79a7a638d77df7f47001d8f884e88ee4497bd1e05c1dae6fa67fb3dd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14722\base_library.zip

Filesize
1.4MB

MD5
9dc12ea9f7821873da74c772abb280f0

SHA1
3f271c9f54bc7740b95eaa20debbd156ebd50760

SHA256
c5ec59385bfac2a0ac38abf1377360cd1fddd05c31f8a8b4e44252e0e63acb10

SHA512
a3175c170bbb28c199ab74ad3116e71f03f124d448bf0e9dd4afcacdc08a7a52284cf858cfd7e72d35bd1e68c6ba0c2a1a0025199aeb671777977ea53e1f2535

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14722\libcrypto-1_1.dll

Filesize
3.3MB

MD5
6f4b8eb45a965372156086201207c81f

SHA1
8278f9539463f0a45009287f0516098cb7a15406

SHA256
976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

SHA512
2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14722\libffi-8.dll

Filesize
37KB

MD5
d86a9d75380fab7640bb950aeb05e50e

SHA1
1c61aaf9022cd1f09a959f7b2a65fb1372d187d7

SHA256
68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b

SHA512
18437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14722\python311.dll

Filesize
5.5MB

MD5
a72993488cecd88b3e19487d646f88f6

SHA1
5d359f4121e0be04a483f9ad1d8203ffc958f9a0

SHA256
aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038

SHA512
c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14722\select.pyd

Filesize
28KB

MD5
116335ebc419dd5224dd9a4f2a765467

SHA1
482ef3d79bfd6b6b737f8d546cd9f1812bd1663d

SHA256
813eede996fc08e1c9a6d45aaa4cbae1e82e781d69885680a358b4d818cfc0d4

SHA512
41dc7facab0757ed1e286ae8e41122e09738733ad110c2918f5e2120dfb0dbff0daefcad2bffd1715b15b44c861b1dd7fb0d514983db50ddc758f47c1b9b3bf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14722\unicodedata.pyd

Filesize
1.1MB

MD5
cdb5f373d24adceb4dc4fa1677757f0c

SHA1
af6b381eed65d244c57129346008ec8532ba336b

SHA256
175c4cb528f1ac4e285c575cc3f5e85ec4b3ae88860210b5d795b580c7f0b5d9

SHA512
429a326648c761bf068ca7735094644f532d631cf9355c9f1a5743a5791837a36cd6aa2efe2265c7541feb06310d0c07b634dd04438d8eddbdf1c4147938a868

Download Submit
memory/316-33-0x000001847BDA0000-0x000001847BDB7000-memory.dmp

Filesize
92KB

Download
memory/316-35-0x00007FFB97D63000-0x00007FFB97D65000-memory.dmp

Filesize
8KB

Download
memory/316-36-0x000001847D8D0000-0x000001847D8E6000-memory.dmp

Filesize
88KB

Download
memory/316-37-0x00007FFB97D60000-0x00007FFB98821000-memory.dmp

Filesize
10.8MB

Download
memory/316-38-0x00007FFB97D60000-0x00007FFB98821000-memory.dmp

Filesize
10.8MB

Download
memory/316-39-0x00007FFB97D63000-0x00007FFB97D65000-memory.dmp

Filesize
8KB

Download
memory/316-40-0x00007FFB97D60000-0x00007FFB98821000-memory.dmp

Filesize
10.8MB

Download
memory/4556-31-0x000001B040A40000-0x000001B040C40000-memory.dmp

Filesize
2.0MB

Download
memory/4556-32-0x000001B0410A0000-0x000001B0410FB000-memory.dmp

Filesize
364KB

Download
memory/4556-34-0x000001B0410A0000-0x000001B0410FB000-memory.dmp

Filesize
364KB

Download