asyncrat | f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe
Size

6.6MB
MD5

10927dbe47f47c1f4260bf4723ed0912
SHA1

0ed62e76ca8d7e9e7ba514d5ed9aa24ddaf4f22d
SHA256

f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526
SHA512

ecb833ffbb4dd8ec25ff5e39a8ce6c4d0c36dcd02873ebc0fbfcf561ad1270db6dde600ea429800c538eaa9adae10cc1f8c45d4f469a59d1123b203e3a8867f9
SSDEEP

98304:CCj8xgBfao1hZlzb71QGQCPDbZfxz87le5BLoHLSLgj8NnJwFDDEy2nZsBJ1nCkS:jjhaofdQmRKuErSEEJwdFvZnCkK

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

todfg.duckdns.org:6745

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
updateee.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe

description	pid	Process	procid_target
PID 1208 created 3580	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	56

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2440-36-0x000002133F9C0000-0x000002133F9D2000-memory.dmp	family_asyncrat

Loads dropped DLL 4 IoCs

Processes:

f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe

pid	Process
1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe
1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe
1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe
1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe

pid	Process
1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe

pid	Process
1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

notepad.exe

description	pid	Process
Token: SeDebugPrivilege	2440	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exef08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe

description	pid	Process	procid_target
PID 1092 wrote to memory of 1208	1092	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	84
PID 1092 wrote to memory of 1208	1092	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	84
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88
PID 1208 wrote to memory of 2440	1208	f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe	88

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3580
- C:\Users\Admin\AppData\Local\Temp\f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe
  "C:\Users\Admin\AppData\Local\Temp\f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Users\Admin\AppData\Local\Temp\f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe
    "C:\Users\Admin\AppData\Local\Temp\f08b325f5322a698e14f97db29d322e9ee91ad636ac688af352d51057fc56526.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1208
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI10922\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10922\_bz2.pyd

Filesize
81KB

MD5
10d42efac304861ad19821b4594fa959

SHA1
1a65f60bba991bc7e9322af1e19f193dae76d77a

SHA256
8eecdcc250637652e6babc306ea6b8820e9e835ddd2434816d0e0fd0ca67fd14

SHA512
3f16dba627a133586e9d1c16d383b9461424d31892278ab984f7e6932a1cdc51445e1bec017a665bd66c0f2a9ba417387fecc5fdede36d67f8343b82a2ceb9ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10922\_ctypes.pyd

Filesize
120KB

MD5
df6be515e183a0e4dbe9cdda17836664

SHA1
a5e8796189631c1aaca6b1c40bc5a23eb20b85db

SHA256
af598ae52ddc6869f24d36a483b77988385a5bbbf4618b2e2630d89d10a107ee

SHA512
b3f23530de7386cc4dcf6ad39141240e56d36322e3d4041e40d69d80dd529d1f8ef5f65b55cdca9641e378603b5252acfe5d50f39f0c6032fd4c307f73ef9253

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10922\_decimal.pyd

Filesize
245KB

MD5
a1ffc2a156e9266932c351a88e5e7fab

SHA1
ebfc901c28035264fbb5b0f30e68ab3b45410d13

SHA256
b8409829dc4fde70f38754de55d3090a1cd52c78ffece2a08572a58de3af294d

SHA512
74fecaac362deff5139ea8553142ba7e8a7740b757a06edf16cf4a9320a20e7a1567380bfe2f40a3b7e8508f9715efedf27c6c23d2b2fb3ed7664cb81f6d58d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10922\_hashlib.pyd

Filesize
62KB

MD5
f419ac6e11b4138eea1fe8c86689076a

SHA1
886cda33fa3a4c232caa0fa048a08380971e8939

SHA256
441d32922122e59f75a728cc818f8e50613866a6c3dec627098e6cc6c53624e2

SHA512
6b5aa5f5fbc00fb48f49b441801ee3f3214bd07382444569f089efb02a93ce907f6f4e0df281bda81c80f2d6a247b0adc7c2384a2e484bc7ef43b43c84756d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10922\_lzma.pyd

Filesize
153KB

MD5
3230404a7191c6228a8772d3610e49e5

SHA1
4e8e36c89b4ff440ddff9a5b084b262c9b2394ec

SHA256
33ae42f744d2688bb7d5519f32ff7b7489b96f4eea47f66d2009dba6a0023903

SHA512
6ecce0c8e8b3d42275d486e8ff495e81e36adaaacaaa3db37844e204fcdaa6d89cb3d81c43d9e16d938cd8b6671b8800fe74a1e723a9187b0566a8f3c39d5d5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10922\_socket.pyd

Filesize
76KB

MD5
0fc65ec300553d8070e6b44b9b23b8c0

SHA1
f8db6af578cf417cfcddb2ed798c571c1abd878f

SHA256
360744663fce8dec252abbda1168f470244fdb6da5740bb7ab3171e19106e63c

SHA512
cba375a815db973b4e8babda951d1a4ca90a976e9806e9a62520a0729937d25de8e600e79a7a638d77df7f47001d8f884e88ee4497bd1e05c1dae6fa67fb3dd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10922\base_library.zip

Filesize
1.4MB

MD5
9dc12ea9f7821873da74c772abb280f0

SHA1
3f271c9f54bc7740b95eaa20debbd156ebd50760

SHA256
c5ec59385bfac2a0ac38abf1377360cd1fddd05c31f8a8b4e44252e0e63acb10

SHA512
a3175c170bbb28c199ab74ad3116e71f03f124d448bf0e9dd4afcacdc08a7a52284cf858cfd7e72d35bd1e68c6ba0c2a1a0025199aeb671777977ea53e1f2535

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10922\libcrypto-1_1.dll

Filesize
3.3MB

MD5
6f4b8eb45a965372156086201207c81f

SHA1
8278f9539463f0a45009287f0516098cb7a15406

SHA256
976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

SHA512
2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10922\libffi-8.dll

Filesize
37KB

MD5
d86a9d75380fab7640bb950aeb05e50e

SHA1
1c61aaf9022cd1f09a959f7b2a65fb1372d187d7

SHA256
68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b

SHA512
18437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10922\python311.dll

Filesize
5.5MB

MD5
a72993488cecd88b3e19487d646f88f6

SHA1
5d359f4121e0be04a483f9ad1d8203ffc958f9a0

SHA256
aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038

SHA512
c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10922\select.pyd

Filesize
28KB

MD5
116335ebc419dd5224dd9a4f2a765467

SHA1
482ef3d79bfd6b6b737f8d546cd9f1812bd1663d

SHA256
813eede996fc08e1c9a6d45aaa4cbae1e82e781d69885680a358b4d818cfc0d4

SHA512
41dc7facab0757ed1e286ae8e41122e09738733ad110c2918f5e2120dfb0dbff0daefcad2bffd1715b15b44c861b1dd7fb0d514983db50ddc758f47c1b9b3bf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10922\unicodedata.pyd

Filesize
1.1MB

MD5
cdb5f373d24adceb4dc4fa1677757f0c

SHA1
af6b381eed65d244c57129346008ec8532ba336b

SHA256
175c4cb528f1ac4e285c575cc3f5e85ec4b3ae88860210b5d795b580c7f0b5d9

SHA512
429a326648c761bf068ca7735094644f532d631cf9355c9f1a5743a5791837a36cd6aa2efe2265c7541feb06310d0c07b634dd04438d8eddbdf1c4147938a868

Download Submit
memory/1208-31-0x0000019520DA0000-0x0000019520FA0000-memory.dmp

Filesize
2.0MB

Download
memory/1208-32-0x0000019521450000-0x00000195214A6000-memory.dmp

Filesize
344KB

Download
memory/1208-34-0x0000019521450000-0x00000195214A6000-memory.dmp

Filesize
344KB

Download
memory/2440-33-0x000002133DD70000-0x000002133DD82000-memory.dmp

Filesize
72KB

Download
memory/2440-35-0x00007FFD35053000-0x00007FFD35055000-memory.dmp

Filesize
8KB

Download
memory/2440-36-0x000002133F9C0000-0x000002133F9D2000-memory.dmp

Filesize
72KB

Download
memory/2440-37-0x00007FFD35050000-0x00007FFD35B11000-memory.dmp

Filesize
10.8MB

Download
memory/2440-38-0x00007FFD35053000-0x00007FFD35055000-memory.dmp

Filesize
8KB

Download
memory/2440-39-0x00007FFD35050000-0x00007FFD35B11000-memory.dmp

Filesize
10.8MB

Download