Analysis
-
max time kernel
203s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
08-07-2024 19:31
General
-
Target
Anarchy Panel 4.7.rar
-
Size
53.7MB
-
MD5
a14b107b10b4004aedb2fd1a131e9ca0
-
SHA1
854f03955b29bbd7374a66d246fb09289437973a
-
SHA256
ac8b0b40b2f088a805601a7de7df58a8ebca6f03921f44305cb5191b98ca6be7
-
SHA512
0eb2875c662be700e07dd4e16be3c5e82f2af747531525765ebab8f278a5773747a8a16f2057ee1a1115fb71283490463b9be17c61bfed9517937c1fa5863585
-
SSDEEP
786432:wxvuATq6zudBSMnaTsS2DaajJeMixRbF9Bf+XDIUpGm5sCs2AvU/SmCOAPnEV:wxmATSSMus/hZaxDBtU7iLA3ycV
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Anarchy Panel 4.7.rar"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap6939:92:7zEvent134971⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\Anarchy Panel 4.7\Anarchy Panel.exe"C:\Users\Admin\Desktop\Anarchy Panel 4.7\Anarchy Panel.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtAddPFX C:\Users\Admin\Desktop\Anarchy Panel 4.7\Usrs.p121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD556a504a34d2cfbfc7eaa2b68e34af8ad
SHA1426b48b0f3b691e3bb29f465aed9b936f29fc8cc
SHA2569309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961
SHA512170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7
-
Filesize
1KB
MD5950b74f192530e30574cbd7ebeb7950e
SHA16f3771378b368263402a395d0c764f66590fd77e
SHA256ca3231604f4a38fd8001d5b6d441c9b61bbccdae4019d68c0456b6db55560550
SHA5125a7073155d2ba4270a507af7accc3e165fec3a364beb65d79facc5166a085dca6ed074655c2027790a6019509b6ab8ba0ad3492d7c95093af4c064d74b1c0784
-
Filesize
3KB
MD53d441f780367944d267e359e4786facd
SHA1d3a4ba9ffc555bbc66207dfdaf3b2d569371f7b5
SHA25649648bbe8ec16d572b125fff1f0e7faa19e1e8c315fd2a1055d6206860a960c9
SHA5125f17ec093cdce3dbe2cb62fec264b3285aabe7352c1d65ec069ffbc8a17a9b684850fe38c1ffd8b0932199c820881d255c8d1e6000cbbe85587c98e88c9acb90
-
Filesize
1KB
MD529d05f26237337f84db3ac84a8c85a18
SHA167981b91410af6c7e075120708f0c874682192a1
SHA256a831ffcc46ff7f49ecb107341eeae12326a4be6c3aa904a03f9a6b65eb64f58e
SHA512642f8806a06ed97e17107ff643fd0ca62720b69fa671d55dcd9c78cc1886a050452c87d357a3bb18994000cc2367194dccd333f778a622cd805308581bd1f800
-
Filesize
80KB
-
Filesize
3.8MB
-
Filesize
2.3MB
-
Filesize
1.3MB
-
Filesize
5.9MB
-
Filesize
72KB
-
Filesize
2.5MB
-
Filesize
40KB
-
Filesize
22.5MB
-
Filesize
22.5MB
-
Filesize
72KB
-
Filesize
54.6MB