Overview
overview
10Static
static
10ratted/Ana...el.exe
windows7-x64
10ratted/Ana...el.exe
windows10-2004-x64
10ratted/Plu...oG.dll
windows7-x64
1ratted/Plu...oG.dll
windows10-2004-x64
1ratted/Plu...uJ.dll
windows7-x64
1ratted/Plu...uJ.dll
windows10-2004-x64
1ratted/Plu...qM.dll
windows7-x64
1ratted/Plu...qM.dll
windows10-2004-x64
1ratted/Plu...LC.dll
windows7-x64
1ratted/Plu...LC.dll
windows10-2004-x64
1ratted/Plu...wp.dll
windows7-x64
1ratted/Plu...wp.dll
windows10-2004-x64
1ratted/Plu...uZ.dll
windows7-x64
1ratted/Plu...uZ.dll
windows10-2004-x64
1ratted/Plu...nG.dll
windows7-x64
1ratted/Plu...nG.dll
windows10-2004-x64
1ratted/Plu...TS.dll
windows7-x64
1ratted/Plu...TS.dll
windows10-2004-x64
1ratted/Plu...xj.dll
windows7-x64
1ratted/Plu...xj.dll
windows10-2004-x64
1ratted/Plu...pi.dll
windows7-x64
1ratted/Plu...pi.dll
windows10-2004-x64
1ratted/Plu...s4.dll
windows7-x64
1ratted/Plu...s4.dll
windows10-2004-x64
1ratted/Plu...Ya.dll
windows7-x64
1ratted/Plu...Ya.dll
windows10-2004-x64
1ratted/Plu...Jn.dll
windows7-x64
1ratted/Plu...Jn.dll
windows10-2004-x64
1ratted/Plu...GA.dll
windows7-x64
1ratted/Plu...GA.dll
windows10-2004-x64
1ratted/Plu...DG.dll
windows7-x64
1ratted/Plu...DG.dll
windows10-2004-x64
1Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2023 01:29
Behavioral task
behavioral1
Sample
ratted/Anarchy Panel.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
ratted/Anarchy Panel.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral3
Sample
ratted/Plugins/0guo3zbo66fqoG.dll
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
ratted/Plugins/0guo3zbo66fqoG.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral5
Sample
ratted/Plugins/59Zp7paEHDF7luJ.dll
Resource
win7-20231025-en
Behavioral task
behavioral6
Sample
ratted/Plugins/59Zp7paEHDF7luJ.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral7
Sample
ratted/Plugins/CjETR6GpGXqM.dll
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
ratted/Plugins/CjETR6GpGXqM.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral9
Sample
ratted/Plugins/EVa7gBMKoaHmLC.dll
Resource
win7-20231020-en
Behavioral task
behavioral10
Sample
ratted/Plugins/EVa7gBMKoaHmLC.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral11
Sample
ratted/Plugins/FBSyChwp.dll
Resource
win7-20231020-en
Behavioral task
behavioral12
Sample
ratted/Plugins/FBSyChwp.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral13
Sample
ratted/Plugins/G3nl0mDcABnDuZ.dll
Resource
win7-20231023-en
Behavioral task
behavioral14
Sample
ratted/Plugins/G3nl0mDcABnDuZ.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral15
Sample
ratted/Plugins/KNTmoSnG.dll
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
ratted/Plugins/KNTmoSnG.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral17
Sample
ratted/Plugins/PK0TcnqTGFagQTS.dll
Resource
win7-20231025-en
Behavioral task
behavioral18
Sample
ratted/Plugins/PK0TcnqTGFagQTS.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral19
Sample
ratted/Plugins/RssCnLKcGRxj.dll
Resource
win7-20231020-en
Behavioral task
behavioral20
Sample
ratted/Plugins/RssCnLKcGRxj.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral21
Sample
ratted/Plugins/WkUP83aP9CABpi.dll
Resource
win7-20231023-en
Behavioral task
behavioral22
Sample
ratted/Plugins/WkUP83aP9CABpi.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral23
Sample
ratted/Plugins/eMTYbTz0gueNs4.dll
Resource
win7-20231023-en
Behavioral task
behavioral24
Sample
ratted/Plugins/eMTYbTz0gueNs4.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral25
Sample
ratted/Plugins/fzAgyDYa.dll
Resource
win7-20231023-en
Behavioral task
behavioral26
Sample
ratted/Plugins/fzAgyDYa.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral27
Sample
ratted/Plugins/mGWHaG2Jn.dll
Resource
win7-20231023-en
Behavioral task
behavioral28
Sample
ratted/Plugins/mGWHaG2Jn.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral29
Sample
ratted/Plugins/mML6WKMqdxjDGA.dll
Resource
win7-20231020-en
Behavioral task
behavioral30
Sample
ratted/Plugins/mML6WKMqdxjDGA.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral31
Sample
ratted/Plugins/oYsKwDG.dll
Resource
win7-20231023-en
Behavioral task
behavioral32
Sample
ratted/Plugins/oYsKwDG.dll
Resource
win10v2004-20231127-en
General
-
Target
ratted/Anarchy Panel.exe
-
Size
54.6MB
-
MD5
94bac1a0cc0dbac256f0d3b4c90648c2
-
SHA1
4abcb8a31881e88322f6a37cbb24a14a80c6eef2
-
SHA256
50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
-
SHA512
30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9
-
SSDEEP
786432:RvcKHU1yll1EcgYwm/7hPo9b9DMs2PTUpRYj:lPU4bZwm/NwEIYj
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1964-1-0x0000000000BE0000-0x000000000427E000-memory.dmp family_zgrat_v1 -
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1964-1-0x0000000000BE0000-0x000000000427E000-memory.dmp asyncrat -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral2/memory/1964-1-0x0000000000BE0000-0x000000000427E000-memory.dmp net_reactor -
Loads dropped DLL 1 IoCs
Processes:
Anarchy Panel.exepid process 1964 Anarchy Panel.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Anarchy Panel.exedescription pid process Token: SeDebugPrivilege 1964 Anarchy Panel.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD556a504a34d2cfbfc7eaa2b68e34af8ad
SHA1426b48b0f3b691e3bb29f465aed9b936f29fc8cc
SHA2569309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961
SHA512170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7