Analysis
- max time kernel
36s - max time network
49s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/05/2024, 22:10
General
- Target Anarchy Panel.exe
- Size 54.6MB
- Sample240510-13vpssfd65
- SHA256 50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
Malware Config
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Loads dropped DLL 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
sqlite.interop.dll
memory/1932-9-0x000000001F890000-0x000000001FE78000-memory.dmp
memory/1932-2-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp
memory/1932-3-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp
memory/1932-1-0x0000000000440000-0x0000000003ADE000-memory.dmp
memory/1932-8-0x00000000043F0000-0x0000000004402000-memory.dmp
memory/1932-0-0x00007FFAE3683000-0x00007FFAE3685000-memory.dmp
memory/1932-10-0x000000001FE80000-0x0000000020240000-memory.dmp
memory/1932-11-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp
memory/1932-12-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp
memory/1932-13-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp
memory/1932-14-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp
memory/1932-15-0x00007FFAE3683000-0x00007FFAE3685000-memory.dmp
memory/1932-16-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp