| File name: | 33.exe |
| Full analysis: | https://app.any.run/tasks/e7a47097-c968-4bca-b80e-56727863b59a |
| Verdict: | Malicious activity |
| Threats: | AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions. |
| Analysis date: | January 10, 2025, 23:00:03 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64, for MS Windows, 6 sections |
| MD5: | 4E3A006CE15ACA43DA90672230A796C1 |
| SHA1: | DFF8CA029E78D234B98D5E7D985023CFC082DC83 |
| SHA256: | 0A1F90B176650067E0D08E1C9D801D9A62F111D03147F4E031DC0B171414F0E9 |
| SSDEEP: | 98304:5J3eSS/UsyZkzKVfqvWj98WVeIg8S3qfJQ1knyuyskVRCPZovL2dyx3W5CF9GwKw:/fmUaDGckQBObnTysr0Cl |
MALICIOUS
ASYNCRAT has been detected (MUTEX)
- 0a6372bd.exe (PID: 6664)
ASYNCRAT has been detected (YARA)
- 0a6372bd.exe (PID: 6664)
SUSPICIOUS
The process drops C-runtime libraries
- 33.exe (PID: 6520)
Executable content was dropped or overwritten
- 33.exe (PID: 6520)
- 33.exe (PID: 6540)
Process drops legitimate windows executable
- 33.exe (PID: 6520)
Process drops python dynamic module
- 33.exe (PID: 6520)
Application launched itself
- 33.exe (PID: 6520)
Loads Python modules
- 33.exe (PID: 6540)
The executable file from the user directory is run by the CMD process
- 0a6372bd.exe (PID: 6664)
Starts CMD.EXE for commands execution
- 33.exe (PID: 6540)
INFO
The sample compiled with english language support
- 33.exe (PID: 6520)
Reads the computer name
- 33.exe (PID: 6520)
- 0a6372bd.exe (PID: 6664)
Checks supported languages
- 33.exe (PID: 6520)
- 33.exe (PID: 6540)
- 0a6372bd.exe (PID: 6664)
Create files in a temporary directory
- 33.exe (PID: 6520)
- 33.exe (PID: 6540)
Reads the machine GUID from the registry
- 0a6372bd.exe (PID: 6664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2025:01:10 22:51:39+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.41 |
| CodeSize: | 172032 |
| InitializedDataSize: | 154624 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xce20 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
Total processes
121
Monitored processes
5
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6520 | "C:\Users\admin\Desktop\33.exe" | C:\Users\admin\Desktop\33.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 6540 | "C:\Users\admin\Desktop\33.exe" | C:\Users\admin\Desktop\33.exe | 33.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 6564 | C:\WINDOWS\system32\cmd.exe /c start /min C:\Users\admin\AppData\Local\Temp\0a6372bd.exe | C:\Windows\System32\cmd.exe | — | 33.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6572 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6664 | C:\Users\admin\AppData\Local\Temp\0a6372bd.exe | C:\Users\admin\AppData\Local\Temp\0a6372bd.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Version: 1.0.0.0 Modules
| |||||||||||||||
Total events
394
Read events
394
Write events
0
Delete events
0
Modification events
Executable files
16
Suspicious files
1
Text files
8
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6520 | 33.exe | C:\Users\admin\AppData\Local\Temp\_MEI65202\VCRUNTIME140.dll | executable | |
MD5:862F820C3251E4CA6FC0AC00E4092239 | SHA256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153 | |||
| 6520 | 33.exe | C:\Users\admin\AppData\Local\Temp\_MEI65202\_bz2.pyd | executable | |
MD5:C17DCB7FC227601471A641EC90E6237F | SHA256:55894B2B98D01F37B9A8CF4DAF926D0161FF23C2FB31C56F9DBBAC3A61932712 | |||
| 6520 | 33.exe | C:\Users\admin\AppData\Local\Temp\_MEI65202\_decimal.pyd | executable | |
MD5:AD4324E5CC794D626FFCCDA544A5A833 | SHA256:040F361F63204B55C17A100C260C7DDFADD00866CC055FBD641B83A6747547D5 | |||
| 6520 | 33.exe | C:\Users\admin\AppData\Local\Temp\_MEI65202\_cffi_backend.cp313-win_amd64.pyd | executable | |
MD5:5CBA92E7C00D09A55F5CBADC8D16CD26 | SHA256:0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85 | |||
| 6520 | 33.exe | C:\Users\admin\AppData\Local\Temp\_MEI65202\_hashlib.pyd | executable | |
MD5:422E214CA76421E794B99F99A374B077 | SHA256:78223AEF72777EFC93C739F5308A3FC5DE28B7D10E6975B8947552A62592772B | |||
| 6520 | 33.exe | C:\Users\admin\AppData\Local\Temp\_MEI65202\_socket.pyd | executable | |
MD5:ABF998769F3CBA685E90FA06E0EC8326 | SHA256:62D0493CED6CA33E2FD8141649DD9889C23B2E9AFC5FDF56EDB4F888C88FB823 | |||
| 6520 | 33.exe | C:\Users\admin\AppData\Local\Temp\_MEI65202\_ctypes.pyd | executable | |
MD5:2BD5DABBB35398A506E3406BC01EBA26 | SHA256:5C4C489AC052795C27AF063C96BC4DB5AB250144D4839050CFA9BB3836B87C32 | |||
| 6520 | 33.exe | C:\Users\admin\AppData\Local\Temp\_MEI65202\python3.dll | executable | |
MD5:AD2C4784C3240063EEAA646FD59BE62C | SHA256:C1DE4BFE57DC4A5BE8C72C865D617DC39DFD8162FCD2CE1FAC9F401CF9EFB504 | |||
| 6520 | 33.exe | C:\Users\admin\AppData\Local\Temp\_MEI65202\cryptography\hazmat\bindings\_rust.pyd | executable | |
MD5:34293B976DA366D83C12D8EE05DE7B03 | SHA256:A2285C3F2F7E63BA8A17AB5D0A302740E6ADF7E608E0707A7737C1EC3BD8CECC | |||
| 6520 | 33.exe | C:\Users\admin\AppData\Local\Temp\_MEI65202\libcrypto-3.dll | executable | |
MD5:123AD0908C76CCBA4789C084F7A6B8D0 | SHA256:4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
22
DNS requests
7
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1460 | svchost.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1460 | svchost.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1460 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 2.16.204.156:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1460 | svchost.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.253.202:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
1460 | svchost.exe | 2.16.253.202:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |