Analysis

  • max time kernel
    151s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    09/04/2023, 00:32

General

  • Target

    AnyDesk (DROPSY).exe

  • Size

    8.4MB

  • MD5

    473a3c8d7f09e0c24ceedcb639fc3d93

  • SHA1

    df560493b628b30b43e9ed71e1c419a9465690f6

  • SHA256

    f0c95b09ead49d1fe42e25f6d4f8bbcd3492d28c8f508e45e59feb31f4011c3e

  • SHA512

    28e7d47cc85633742139e2188161f1104190e6259eb3b4f274fb3cc7a1a91b6f9a37c804c7a744b4b2feba77b6b6e5c3bcf67aa22a9e29d69152202d9337aa53

  • SSDEEP

    196608:abstwhbd7KSM/cVBP6uYLDYKFlhbstwhbd7KSM/cVB:abstahKSzVBSrL0ObstahKSzVB

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 33 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AnyDesk (DROPSY).exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk (DROPSY).exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:1100

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\ba012cba-2679-4da3-a26b-788d51617354\AgileDotNetRT.dll

          Filesize

          94KB

          MD5

          14ff402962ad21b78ae0b4c43cd1f194

          SHA1

          f8a510eb26666e875a5bdd1cadad40602763ad72

          SHA256

          fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

          SHA512

          daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

        • \Users\Admin\AppData\Local\Temp\ba012cba-2679-4da3-a26b-788d51617354\AgileDotNetRT.dll

          Filesize

          94KB

          MD5

          14ff402962ad21b78ae0b4c43cd1f194

          SHA1

          f8a510eb26666e875a5bdd1cadad40602763ad72

          SHA256

          fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

          SHA512

          daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

        • memory/1100-88-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-80-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-58-0x00000000009D0000-0x00000000009E0000-memory.dmp

          Filesize

          64KB

        • memory/1100-59-0x00000000065B0000-0x0000000006678000-memory.dmp

          Filesize

          800KB

        • memory/1100-56-0x0000000005370000-0x00000000055B4000-memory.dmp

          Filesize

          2.3MB

        • memory/1100-55-0x00000000099C0000-0x0000000009A00000-memory.dmp

          Filesize

          256KB

        • memory/1100-66-0x0000000073FE0000-0x0000000074060000-memory.dmp

          Filesize

          512KB

        • memory/1100-67-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-68-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-70-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-72-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-74-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-76-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-78-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-90-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-82-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-84-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-86-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-57-0x0000000006750000-0x000000000698A000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-54-0x0000000000E10000-0x0000000001680000-memory.dmp

          Filesize

          8.4MB

        • memory/1100-104-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-94-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-96-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-98-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-102-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-92-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-106-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-108-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-100-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-110-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-112-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-114-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-116-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-118-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-120-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-122-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-124-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-126-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-128-0x0000000006750000-0x0000000006985000-memory.dmp

          Filesize

          2.2MB

        • memory/1100-464-0x00000000099C0000-0x0000000009A00000-memory.dmp

          Filesize

          256KB