7ecfcfc4ea9e2c28f52836fb1122bf7327a77308b6bee25226967876d2ae889a

Analysis

max time kernel
156s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnkaBotPC_4.0.5/AnkaBotPC/AnkaBot.exe
Size

5.2MB
MD5

3ec5bba148ed1f017a5de13b3064351b
SHA1

d51752cefc6f97b2048d5c2251cd7bdcdd76b3d8
SHA256

2b6fb5f33d759fa73e82a010bab5b72be0a4f457df44438f773e22aa15c7e153
SHA512

322b93f495600ebfaef1bed4e4d53c827cc0c7a57bff7e0836f337f89a23aed3c05e11fcfb89b75d4473ef75af242ca26f92bb063f7286c7c9e08469dee19b43
SSDEEP

49152:kCFTcDoLTpw84MLRoVpTHOI1TFbH049FV3id9vYI90u/Wjy/zppP1s742SoNj2Pf:PTcDiTp8ML0ROIw+Zj00u/WWzpp18xK

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AnkaBot.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	AnkaBot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

AnkaBot.exeApplication.exeApplication.exe

pid process

2188 AnkaBot.exe
4512 Application.exe
4512 Application.exe
2384 Application.exe
2384 Application.exe
2384 Application.exe
2384 Application.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AnkaBot.exe

description pid process

Token: SeDebugPrivilege 2188 AnkaBot.exe

pid	process
2188	AnkaBot.exe
4512	Application.exe
4512	Application.exe
2384	Application.exe
2384	Application.exe
2384	Application.exe
2384	Application.exe

description	pid	process
Token: SeDebugPrivilege	2188	AnkaBot.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

AnkaBot.exeApplication.exe

description	pid	process	target process
PID 2188 wrote to memory of 2052	2188	AnkaBot.exe	Application.exe
PID 2188 wrote to memory of 2052	2188	AnkaBot.exe	Application.exe
PID 2188 wrote to memory of 2052	2188	AnkaBot.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4364	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4512	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4512	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 4512	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 2384	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 2384	2052	Application.exe	Application.exe
PID 2052 wrote to memory of 2384	2052	Application.exe	Application.exe

C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\AnkaBot.exe
"C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\AnkaBot.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188

C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\Application.exe
"C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\Application.exe" 49746 127.0.0.1:49747 2188
2⤵
- Suspicious use of WriteProcessMemory
PID:2052

C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\Application.exe
"C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\Application.exe" --type=gpu-process --field-trial-handle=1528,3874662750269030831,5203212664363373134,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Application" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 /prefetch:2
3⤵
PID:4364

C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\Application.exe
"C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\Application.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,3874662750269030831,5203212664363373134,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --proxy-server=127.0.0.1:49747 --user-data-dir="C:\Users\Admin\AppData\Roaming\Application" --mojo-platform-channel-handle=1876 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512

C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\Application.exe
"C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\Application.exe" --type=gpu-process --field-trial-handle=1528,3874662750269030831,5203212664363373134,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Application" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4720

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-136-0x0000000000000000-mapping.dmp

Download
memory/2188-132-0x0000000000EA0000-0x0000000001806000-memory.dmp

Filesize
9.4MB

Download
memory/2188-134-0x0000000008AE0000-0x0000000009084000-memory.dmp

Filesize
5.6MB

Download
memory/2188-135-0x00000000097F0000-0x0000000009882000-memory.dmp

Filesize
584KB

Download
memory/2188-137-0x0000000009D50000-0x0000000009DEC000-memory.dmp

Filesize
624KB

Download
memory/2188-138-0x000000000A340000-0x000000000A34A000-memory.dmp

Filesize
40KB

Download
memory/2188-143-0x00000000065F0000-0x0000000006608000-memory.dmp

Filesize
96KB

Download
memory/2384-144-0x0000000000000000-mapping.dmp

Download
memory/4364-140-0x0000000000000000-mapping.dmp

Download
memory/4512-141-0x0000000000000000-mapping.dmp

Download