Analysis

  • max time kernel
    107s
  • max time network
    90s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-09-2023 01:19

General

  • Target

    Anarchy Panel.exe

  • Size

    54.6MB

  • MD5

    94bac1a0cc0dbac256f0d3b4c90648c2

  • SHA1

    4abcb8a31881e88322f6a37cbb24a14a80c6eef2

  • SHA256

    50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94

  • SHA512

    30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

  • SSDEEP

    786432:RvcKHU1yll1EcgYwm/7hPo9b9DMs2PTUpRYj:lPU4bZwm/NwEIYj

Score
10/10

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 48 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe
    "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4140
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:1396

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Costura\C5730A4C0FDD612A5678E51A536CE09E\64\sqlite.interop.dll

      Filesize

      1.7MB

      MD5

      56a504a34d2cfbfc7eaa2b68e34af8ad

      SHA1

      426b48b0f3b691e3bb29f465aed9b936f29fc8cc

      SHA256

      9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961

      SHA512

      170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7

    • C:\Users\Admin\AppData\Local\Temp\Usrs.p12

      Filesize

      1KB

      MD5

      a8c14c0204e1da23da92b294f1544dcc

      SHA1

      ad1a58ba88d0c70ef2dfed5507abddb6498402ce

      SHA256

      99f819a393672435766e0d345180408592b114a62d5989b6066d1da686c10598

      SHA512

      6547854b22e4fc89582780e961adf694328040e636acff2b3d6c88fbd6bf551389b18914c8182d6c8ed7c92183e3b48cf6ac270c0305b3fa23c36ab23f64485f

    • C:\Users\Admin\AppData\Local\VyLcvAjyZL9oUxnI4mJV\Anarchy_Panel.exe_Url_bhennukkrj4ap4ybumzdxwrmvm3shh42\4.7.0.0\user.config

      Filesize

      1KB

      MD5

      4b01719ab493b81d429c574dbaca15ef

      SHA1

      719ef1e4e6616a3d8afce09de7f89ddcf186a3a3

      SHA256

      33ce546b728989bc9ff5dd4c487a87723e5eb7b3953b7cb56e747747411b6c54

      SHA512

      4d5293d8b58c793bbbe6dedc061cb4fd3e7302771ee91789240ecf80f2f79d08dffc36d148f755107a3d12de6037ab18c57cb42494de80a40d90b64bb04ef234

    • C:\Users\Admin\AppData\Local\VyLcvAjyZL9oUxnI4mJV\Anarchy_Panel.exe_Url_bhennukkrj4ap4ybumzdxwrmvm3shh42\4.7.0.0\user.config

      Filesize

      1KB

      MD5

      495d368baef768dd527dd8b772702c87

      SHA1

      20ceb83c7076024e0491f169173607aa4a2e3931

      SHA256

      38f1820a88401c8e117bfeca56a11aa06dc806a175203e86f323dc6fb81fb3cf

      SHA512

      75770717f4bc7c9bdd13d747fdcd6306c38423b1b5d908b5d7cdf4da1b7bbe722f65bb52e63c61ca6da89981d8f5a99035c1d610a0fdacb706a046520c291d18

    • memory/4140-14-0x000000001E490000-0x000000001E4A0000-memory.dmp

      Filesize

      64KB

    • memory/4140-17-0x000000001E490000-0x000000001E4A0000-memory.dmp

      Filesize

      64KB

    • memory/4140-10-0x000000001E490000-0x000000001E4A0000-memory.dmp

      Filesize

      64KB

    • memory/4140-11-0x000000001E490000-0x000000001E4A0000-memory.dmp

      Filesize

      64KB

    • memory/4140-12-0x00007FF8AFEC0000-0x00007FF8B0981000-memory.dmp

      Filesize

      10.8MB

    • memory/4140-13-0x000000001E490000-0x000000001E4A0000-memory.dmp

      Filesize

      64KB

    • memory/4140-0-0x00007FF8AFEC0000-0x00007FF8B0981000-memory.dmp

      Filesize

      10.8MB

    • memory/4140-15-0x000000001E490000-0x000000001E4A0000-memory.dmp

      Filesize

      64KB

    • memory/4140-16-0x000000001E490000-0x000000001E4A0000-memory.dmp

      Filesize

      64KB

    • memory/4140-9-0x0000000005AB0000-0x0000000005AC2000-memory.dmp

      Filesize

      72KB

    • memory/4140-18-0x000000001E490000-0x000000001E4A0000-memory.dmp

      Filesize

      64KB

    • memory/4140-19-0x000000001E490000-0x000000001E4A0000-memory.dmp

      Filesize

      64KB

    • memory/4140-20-0x000000001E490000-0x000000001E4A0000-memory.dmp

      Filesize

      64KB

    • memory/4140-21-0x00000000246D0000-0x00000000246E2000-memory.dmp

      Filesize

      72KB

    • memory/4140-27-0x000000001E590000-0x000000001E59A000-memory.dmp

      Filesize

      40KB

    • memory/4140-30-0x000000001E490000-0x000000001E4A0000-memory.dmp

      Filesize

      64KB

    • memory/4140-3-0x0000000003E70000-0x0000000003E71000-memory.dmp

      Filesize

      4KB

    • memory/4140-2-0x000000001E490000-0x000000001E4A0000-memory.dmp

      Filesize

      64KB

    • memory/4140-1-0x0000000000230000-0x00000000038CE000-memory.dmp

      Filesize

      54.6MB