Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
23/07/2024, 11:15
General
- Target ares/AnyDesk (ARES).exe
- Size 9.5MB
- Sample240723-nc2zzatdql
- SHA256 2fb6c7512ed9b1685c5af73f6875ca6f085add60ed3ae09f914a73e37d16defe
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ares\AnyDesk (ARES).exe"C:\Users\Admin\AppData\Local\Temp\ares\AnyDesk (ARES).exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
rabu64.dll
SiticoneDotNetRT64.dll
memory/848-49-0x000001A377200000-0x000001A377440000-memory.dmp
memory/848-82-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-4-0x000001A373800000-0x000001A3738EA000-memory.dmp
memory/848-5-0x000001A3589C0000-0x000001A3589C6000-memory.dmp
memory/848-12-0x00007FF8196A0000-0x00007FF81A161000-memory.dmp
memory/848-13-0x00007FF8196A0000-0x00007FF81A161000-memory.dmp
memory/848-15-0x00007FF8196A0000-0x00007FF81A161000-memory.dmp
memory/848-14-0x000001A3589D0000-0x000001A3589D6000-memory.dmp
memory/848-18-0x00007FF8196A0000-0x00007FF81A161000-memory.dmp
memory/848-19-0x00007FF8196A0000-0x00007FF81A161000-memory.dmp
memory/848-20-0x00007FF8196A0000-0x00007FF81A161000-memory.dmp
memory/848-21-0x00007FF8196A0000-0x00007FF81A161000-memory.dmp
memory/848-22-0x000001A3759D0000-0x000001A376664000-memory.dmp
memory/848-23-0x000001A373BA0000-0x000001A373BB4000-memory.dmp
memory/848-24-0x000001A373D30000-0x000001A373D31000-memory.dmp
memory/848-25-0x000001A373D50000-0x000001A373D51000-memory.dmp
memory/848-26-0x000001A376C40000-0x000001A376C41000-memory.dmp
memory/848-29-0x0000000180000000-0x0000000180007000-memory.dmp
memory/848-92-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-38-0x0000000180000000-0x0000000180007000-memory.dmp
memory/848-36-0x0000000180000000-0x0000000180007000-memory.dmp
memory/848-34-0x0000000180000000-0x0000000180007000-memory.dmp
memory/848-33-0x0000000180000000-0x0000000180007000-memory.dmp
memory/848-31-0x0000000180000000-0x0000000180007000-memory.dmp
memory/848-42-0x000001A373D50000-0x000001A373D51000-memory.dmp
memory/848-45-0x000001A373D50000-0x000001A373D51000-memory.dmp
memory/848-47-0x0000000180000000-0x0000000180007000-memory.dmp
memory/848-0-0x00007FF8196A3000-0x00007FF8196A5000-memory.dmp
memory/848-3-0x000001A372AF0000-0x000001A3737F8000-memory.dmp
memory/848-2-0x00007FF8196A0000-0x00007FF81A161000-memory.dmp
memory/848-40-0x0000000180000000-0x0000000180007000-memory.dmp
memory/848-89-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-78-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-64-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-57-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-90-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-87-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-84-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-94-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-81-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-76-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-74-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-72-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-70-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-68-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-66-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-62-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-60-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-58-0x000001A377200000-0x000001A37743B000-memory.dmp
memory/848-56-0x00007FF828CF0000-0x00007FF828E3E000-memory.dmp
memory/848-14042-0x000001A377EE0000-0x000001A378088000-memory.dmp
memory/848-1-0x000001A357C70000-0x000001A358600000-memory.dmp
memory/848-14049-0x00007FF82CFF0000-0x00007FF82D017000-memory.dmp
memory/848-25069-0x00007FF8196A3000-0x00007FF8196A5000-memory.dmp
memory/848-25070-0x00007FF8196A0000-0x00007FF81A161000-memory.dmp
memory/848-25071-0x00007FF8196A0000-0x00007FF81A161000-memory.dmp
memory/848-25072-0x00007FF8196A0000-0x00007FF81A161000-memory.dmp
memory/848-25073-0x00007FF82CFF0000-0x00007FF82D017000-memory.dmp