Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2023, 00:37

General

  • Target

    AnyDesk (DROPSY).exe

  • Size

    8.4MB

  • MD5

    473a3c8d7f09e0c24ceedcb639fc3d93

  • SHA1

    df560493b628b30b43e9ed71e1c419a9465690f6

  • SHA256

    f0c95b09ead49d1fe42e25f6d4f8bbcd3492d28c8f508e45e59feb31f4011c3e

  • SHA512

    28e7d47cc85633742139e2188161f1104190e6259eb3b4f274fb3cc7a1a91b6f9a37c804c7a744b4b2feba77b6b6e5c3bcf67aa22a9e29d69152202d9337aa53

  • SSDEEP

    196608:abstwhbd7KSM/cVBP6uYLDYKFlhbstwhbd7KSM/cVB:abstahKSzVBSrL0ObstahKSzVB

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 32 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AnyDesk (DROPSY).exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk (DROPSY).exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:1640

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\ba012cba-2679-4da3-a26b-788d51617354\AgileDotNetRT.dll

          Filesize

          94KB

          MD5

          14ff402962ad21b78ae0b4c43cd1f194

          SHA1

          f8a510eb26666e875a5bdd1cadad40602763ad72

          SHA256

          fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

          SHA512

          daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

        • C:\Users\Admin\AppData\Local\Temp\ba012cba-2679-4da3-a26b-788d51617354\AgileDotNetRT.dll

          Filesize

          94KB

          MD5

          14ff402962ad21b78ae0b4c43cd1f194

          SHA1

          f8a510eb26666e875a5bdd1cadad40602763ad72

          SHA256

          fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

          SHA512

          daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

        • memory/1640-169-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-165-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-137-0x0000000005AA0000-0x0000000005AAA000-memory.dmp

          Filesize

          40KB

        • memory/1640-135-0x00000000072C0000-0x0000000007864000-memory.dmp

          Filesize

          5.6MB

        • memory/1640-134-0x0000000009EF0000-0x0000000009F00000-memory.dmp

          Filesize

          64KB

        • memory/1640-145-0x0000000072F60000-0x0000000072FE9000-memory.dmp

          Filesize

          548KB

        • memory/1640-146-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-147-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-149-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-151-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-153-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-155-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-157-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-159-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-161-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-163-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-171-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-167-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-136-0x00000000059E0000-0x0000000005A72000-memory.dmp

          Filesize

          584KB

        • memory/1640-133-0x0000000000B60000-0x00000000013D0000-memory.dmp

          Filesize

          8.4MB

        • memory/1640-179-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-175-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-177-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-173-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-181-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-183-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-185-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-187-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-189-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-191-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-193-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-195-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-197-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-199-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-201-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-203-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-205-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-207-0x0000000006E90000-0x00000000070C5000-memory.dmp

          Filesize

          2.2MB

        • memory/1640-270-0x0000000009EF0000-0x0000000009F00000-memory.dmp

          Filesize

          64KB