Overview
overview
10Static
static
10AnkaBotPC_...ot.exe
windows7-x64
1AnkaBotPC_...ot.exe
windows10-2004-x64
7AnkaBotPC_...er.exe
windows7-x64
1AnkaBotPC_...er.exe
windows10-2004-x64
1AnkaBotPC_...xy.exe
windows7-x64
5AnkaBotPC_...xy.exe
windows10-2004-x64
5AnkaBotPC_...er.exe
windows7-x64
1AnkaBotPC_...er.exe
windows10-2004-x64
1AnkaBotPC_...on.exe
windows7-x64
1AnkaBotPC_...on.exe
windows10-2004-x64
1AnkaBotPC_...m.html
windows7-x64
1AnkaBotPC_...m.html
windows10-2004-x64
1AnkaBotPC_...47.dll
windows7-x64
3AnkaBotPC_...47.dll
windows10-2004-x64
3AnkaBotPC_...eg.dll
windows7-x64
1AnkaBotPC_...eg.dll
windows10-2004-x64
1AnkaBotPC_...GL.dll
windows7-x64
1AnkaBotPC_...GL.dll
windows10-2004-x64
1AnkaBotPC_...v2.dll
windows7-x64
3AnkaBotPC_...v2.dll
windows10-2004-x64
3AnkaBotPC_...GL.dll
windows7-x64
1AnkaBotPC_...GL.dll
windows10-2004-x64
1AnkaBotPC_...v2.dll
windows7-x64
1AnkaBotPC_...v2.dll
windows10-2004-x64
1AnkaBotPC_...er.dll
windows7-x64
3AnkaBotPC_...er.dll
windows10-2004-x64
3AnkaBotPC_...-1.dll
windows7-x64
3AnkaBotPC_...-1.dll
windows10-2004-x64
3AnkaBotPC_...ss.exe
windows7-x64
10AnkaBotPC_...ss.exe
windows10-2004-x64
10AnkaBotPC_...er.dll
windows7-x64
1AnkaBotPC_...er.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
15-02-2023 17:24
Behavioral task
behavioral1
Sample
AnkaBotPC_4.0.5/AnkaBotPC/AnkaBot.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
AnkaBotPC_4.0.5/AnkaBotPC/AnkaBot.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
AnkaBotPC_4.0.5/AnkaBotPC/AnkaBotCrashHandler.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
AnkaBotPC_4.0.5/AnkaBotPC/AnkaBotCrashHandler.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
AnkaBotPC_4.0.5/AnkaBotPC/AnkaBotProxy.exe
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
AnkaBotPC_4.0.5/AnkaBotPC/AnkaBotProxy.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
AnkaBotPC_4.0.5/AnkaBotPC/AnkaBotUpdater.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
AnkaBotPC_4.0.5/AnkaBotPC/AnkaBotUpdater.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/Application.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/Application.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/LICENSES.chromium.html
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/LICENSES.chromium.html
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/d3dcompiler_47.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/d3dcompiler_47.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/ffmpeg.dll
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/ffmpeg.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/libEGL.dll
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/libEGL.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/libGLESv2.dll
Resource
win7-20220901-en
Behavioral task
behavioral20
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/libGLESv2.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/swiftshader/libEGL.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/swiftshader/libEGL.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/swiftshader/libGLESv2.dll
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/swiftshader/libGLESv2.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/vk_swiftshader.dll
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/vk_swiftshader.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/vulkan-1.dll
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Application/vulkan-1.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Bypass.exe
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
AnkaBotPC_4.0.5/AnkaBotPC/Bypass.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
AnkaBotPC_4.0.5/AnkaBotPC/MoonSharp.Interpreter.dll
Resource
win7-20221111-en
Behavioral task
behavioral32
Sample
AnkaBotPC_4.0.5/AnkaBotPC/MoonSharp.Interpreter.dll
Resource
win10v2004-20220901-en
General
-
Target
AnkaBotPC_4.0.5/AnkaBotPC/Bypass.exe
-
Size
66KB
-
MD5
ed8ed2bfb05f2f2a5496c4d32095c34b
-
SHA1
57002f5bf97a9ddf1aafd909dcc676e60343d322
-
SHA256
8cabd58822919c0a30ddc7a507e4a55a5d314ec466224791d7814711cf373f6c
-
SHA512
e55c939802586f0b1525dc6e6c8964c37edec8c35b0bfcbd08998807d2c6a4a0d05db6100fc6312be983c585b2270e39d113e7a72a13a8403588a64710be39d1
-
SSDEEP
1536:ToUWMO7oo0sS7UAkj9O8QQHFdCxlTk/sbbXApJZLTD9VclN:TJof9O8QQHFPsbbXI7PY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.0
Default
141.98.11.72:4449
sdtgyxyhor
-
delay
1
-
install
true
-
install_file
Ankabotkey.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral30/memory/4192-132-0x0000000000E60000-0x0000000000E76000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\Ankabotkey.exe asyncrat C:\Users\Admin\AppData\Roaming\Ankabotkey.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Bypass.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation Bypass.exe -
Executes dropped EXE 1 IoCs
Processes:
Ankabotkey.exepid process 4972 Ankabotkey.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3792 timeout.exe -
Suspicious behavior: EnumeratesProcesses 47 IoCs
Processes:
Bypass.exeAnkabotkey.exepid process 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4192 Bypass.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe 4972 Ankabotkey.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Bypass.exeAnkabotkey.exedescription pid process Token: SeDebugPrivilege 4192 Bypass.exe Token: SeDebugPrivilege 4972 Ankabotkey.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Bypass.execmd.execmd.exedescription pid process target process PID 4192 wrote to memory of 5056 4192 Bypass.exe cmd.exe PID 4192 wrote to memory of 5056 4192 Bypass.exe cmd.exe PID 4192 wrote to memory of 4800 4192 Bypass.exe cmd.exe PID 4192 wrote to memory of 4800 4192 Bypass.exe cmd.exe PID 5056 wrote to memory of 3352 5056 cmd.exe schtasks.exe PID 5056 wrote to memory of 3352 5056 cmd.exe schtasks.exe PID 4800 wrote to memory of 3792 4800 cmd.exe timeout.exe PID 4800 wrote to memory of 3792 4800 cmd.exe timeout.exe PID 4800 wrote to memory of 4972 4800 cmd.exe Ankabotkey.exe PID 4800 wrote to memory of 4972 4800 cmd.exe Ankabotkey.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Bypass.exe"C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Bypass.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Ankabotkey" /tr '"C:\Users\Admin\AppData\Roaming\Ankabotkey.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Ankabotkey" /tr '"C:\Users\Admin\AppData\Roaming\Ankabotkey.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9D1F.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Ankabotkey.exe"C:\Users\Admin\AppData\Roaming\Ankabotkey.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9D1F.tmp.batFilesize
154B
MD569a4f25f5f3d8cc27796024effec8078
SHA11c9ed4df2dbcafc4cbb38ee73e21156f8224f947
SHA256d18feaebd4df78db6773aea7c6c858acbfb192952c237a2bf67f8fc0b3b25e4f
SHA5122625e21e6237bccd97d54982d680c5da25d6bb5f6e7a553486f0f8ac44569ead046e1e3c61ca90f859dd0b54df1a79c1d71ad6b714fbffc1d4c28d63adedade7
-
C:\Users\Admin\AppData\Roaming\Ankabotkey.exeFilesize
66KB
MD5ed8ed2bfb05f2f2a5496c4d32095c34b
SHA157002f5bf97a9ddf1aafd909dcc676e60343d322
SHA2568cabd58822919c0a30ddc7a507e4a55a5d314ec466224791d7814711cf373f6c
SHA512e55c939802586f0b1525dc6e6c8964c37edec8c35b0bfcbd08998807d2c6a4a0d05db6100fc6312be983c585b2270e39d113e7a72a13a8403588a64710be39d1
-
C:\Users\Admin\AppData\Roaming\Ankabotkey.exeFilesize
66KB
MD5ed8ed2bfb05f2f2a5496c4d32095c34b
SHA157002f5bf97a9ddf1aafd909dcc676e60343d322
SHA2568cabd58822919c0a30ddc7a507e4a55a5d314ec466224791d7814711cf373f6c
SHA512e55c939802586f0b1525dc6e6c8964c37edec8c35b0bfcbd08998807d2c6a4a0d05db6100fc6312be983c585b2270e39d113e7a72a13a8403588a64710be39d1
-
memory/3352-137-0x0000000000000000-mapping.dmp
-
memory/3792-139-0x0000000000000000-mapping.dmp
-
memory/4192-138-0x00007FFE08EB0000-0x00007FFE09971000-memory.dmpFilesize
10.8MB
-
memory/4192-133-0x00007FFE08EB0000-0x00007FFE09971000-memory.dmpFilesize
10.8MB
-
memory/4192-132-0x0000000000E60000-0x0000000000E76000-memory.dmpFilesize
88KB
-
memory/4800-135-0x0000000000000000-mapping.dmp
-
memory/4972-140-0x0000000000000000-mapping.dmp
-
memory/4972-143-0x00007FFE08EB0000-0x00007FFE09971000-memory.dmpFilesize
10.8MB
-
memory/4972-144-0x00007FFE08EB0000-0x00007FFE09971000-memory.dmpFilesize
10.8MB
-
memory/5056-134-0x0000000000000000-mapping.dmp