asyncrat | bf9aa6957a814d551d3ba7f96690ff76c79ff884718b3a0f16ab17b96c2637ff

Resubmissions

25-09-2024 13:28

240925-qq3jrs1dja 10

24-09-2024 20:51

24-09-2024 19:21

24-09-2024 19:17

24-09-2024 18:11

24-09-2024 17:54

Analysis

max time kernel
232s
max time network
238s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
24-09-2024 20:51

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Anarchy Panel.exe
Size

54.6MB
MD5

94bac1a0cc0dbac256f0d3b4c90648c2
SHA1

4abcb8a31881e88322f6a37cbb24a14a80c6eef2
SHA256

50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
SHA512

30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9
SSDEEP

786432:RvcKHU1yll1EcgYwm/7hPo9b9DMs2PTUpRYj:lPU4bZwm/NwEIYj

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:3221

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x0004000000024fdf-70.dat	family_asyncrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/4920-1-0x00000000001A0000-0x000000000383E000-memory.dmp	net_reactor

Executes dropped EXE 1 IoCs

pid	Process
2616	Infected.exe

Loads dropped DLL 1 IoCs

pid	Process
4920	Anarchy Panel.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2176	timeout.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "253"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000003859a0a610004c6f63616c003c0009000400efbe0259f2783859a0a62e0000007457020000000100000000000000000000000000000039274d004c006f00630061006c00000014000000	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e0031000000000038598fa6100054656d7000003a0009000400efbe0259f278385992a62e000000755702000000010000000000000000000000000000005efbc100540065006d007000000014000000	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Anarchy Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000000259f2781100557365727300640009000400efbec5522d6038598ea62e0000006c0500000000010000000000000000003a0000000000dd00b00055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Anarchy Panel.exe
Key created	\Registry\User\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\NotificationData	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Anarchy Panel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	Anarchy Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 500031000000000002593d7f100041646d696e003c0009000400efbe0259f27838598ea62e0000005557020000000100000000000000000000000000000040a34500410064006d0069006e00000014000000	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Anarchy Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000000259f27812004170704461746100400009000400efbe0259f27838598ea62e00000060570200000001000000000000000000000000000000c5b2a1004100700070004400610074006100000016000000	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	Anarchy Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Anarchy Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Anarchy Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Anarchy Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Anarchy Panel.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe
2616	Infected.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4920	Anarchy Panel.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	Anarchy Panel.exe
Token: SeDebugPrivilege	2616	Infected.exe
Token: SeDebugPrivilege	2616	Infected.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4920	Anarchy Panel.exe
4920	Anarchy Panel.exe
4992	LogonUI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2740	2616	Infected.exe	88
PID 2616 wrote to memory of 2740	2616	Infected.exe	88
PID 2740 wrote to memory of 2176	2740	cmd.exe	90
PID 2740 wrote to memory of 2176	2740	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe
"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4920

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4256

C:\Users\Admin\Downloads\Infected.exe
"C:\Users\Admin\Downloads\Infected.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp655.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2176

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a27055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Costura\C5730A4C0FDD612A5678E51A536CE09E\64\sqlite.interop.dll

Filesize
1.7MB

MD5
56a504a34d2cfbfc7eaa2b68e34af8ad

SHA1
426b48b0f3b691e3bb29f465aed9b936f29fc8cc

SHA256
9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961

SHA512
170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Usrs.p12

Filesize
1KB

MD5
5f5e9223fe5a43c53395d2e6b5ba7d7a

SHA1
eea92790c45ad240ebe8dad3dd9ca2beccd60097

SHA256
346f6ae597612d691824189595f1058d9009544919402197778158fbb9ca38ea

SHA512
71b72fe866a6510226dba70dc02dc85cf65558d6380718e62dd64d884565226056d42951cde5046e78bd9296a62ca46bdedcaac77cb1400ddec53e1c42715b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp655.tmp.bat

Filesize
150B

MD5
4a869b7760fc3b8d4b23eabd5e872293

SHA1
0baf39f4165643fe7b34a50cedf99d35c8a1d462

SHA256
c4ba506181338353cd1a2240eb28c48b5a9772169e7c37fcb982c618b28d5376

SHA512
f79091f9141c0a89233bf1792e6118858208c1e7ee9fc1e421c9e0370333d5ff863009c45635892a8b9c01589c75180e25dd7b01fcd3aa79dfa5dfa614d79520

Download Submit
C:\Users\Admin\AppData\Local\VyLcvAjyZL9oUxnI4mJV\Anarchy_Panel.exe_Url_bhennukkrj4ap4ybumzdxwrmvm3shh42\4.7.0.0\user.config

Filesize
1KB

MD5
2079ae4d3d9227aa7ba9bfa7625d360f

SHA1
795b51eb37c85139b41b6b207216f0ec6348d7b3

SHA256
b789fc77e7b822a97674279c8e1f81f006f55096fdcd41c900e88a15682f6015

SHA512
119d0cff95247d3d7ddab39226d1d32bef3e1cef760777919fdace1117bbf0bec718aada6868340645f0457c0bf72439afef57e23da4b7292d7573a16880ed12

Download Submit
C:\Users\Admin\AppData\Local\VyLcvAjyZL9oUxnI4mJV\Anarchy_Panel.exe_Url_bhennukkrj4ap4ybumzdxwrmvm3shh42\4.7.0.0\user.config

Filesize
1KB

MD5
0a4598a8df7799a1b01c1439705aa6c2

SHA1
5422ddc5dc39be9933e0330b0b00de42b7394b6d

SHA256
76952dffb587e1594b008cb138d10743875f115df912abdf97f63f46b4d5c075

SHA512
227d0353582d3490ff17b7b9ed088ec73d03e1556cc1944d9bef00a4965530e8000a359d74f6e3a6453803be32d6a3999b5bcecc7e562ead4957452525f7ebc7

Download Submit
C:\Users\Admin\Downloads\Infected.exe

Filesize
63KB

MD5
d0629cb5a9b3bc7b35acd4704267236e

SHA1
d1edcf84ffbb0bad4900950f8f0333b2f38b12f2

SHA256
801924b368e62bcecd67c31d9b3b89992bd964e0537abe85b12d5f02347d0301

SHA512
6cc8d59d67b1d73698548a399a2cdd6c812353c3ba307d25f9b40d9fc63a8feeaa44be7a6d967f61c03b7e2fa3370f24bddd9c5eae1a978948a806bf818ef43b

Download Submit
memory/2616-77-0x000000001D270000-0x000000001D322000-memory.dmp

Filesize
712KB

Download
memory/2616-75-0x000000001B620000-0x000000001B63E000-memory.dmp

Filesize
120KB

Download
memory/2616-74-0x0000000002C70000-0x0000000002C8C000-memory.dmp

Filesize
112KB

Download
memory/2616-73-0x000000001D870000-0x000000001D8E6000-memory.dmp

Filesize
472KB

Download
memory/2616-72-0x0000000000A20000-0x0000000000A36000-memory.dmp

Filesize
88KB

Download
memory/4920-21-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-32-0x0000000022240000-0x000000002224A000-memory.dmp

Filesize
40KB

Download
memory/4920-16-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-17-0x0000000023760000-0x00000000239B2000-memory.dmp

Filesize
2.3MB

Download
memory/4920-18-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-19-0x0000000023E30000-0x0000000023F7E000-memory.dmp

Filesize
1.3MB

Download
memory/4920-20-0x0000000021E60000-0x0000000021E74000-memory.dmp

Filesize
80KB

Download
memory/4920-0-0x00007FFED5E03000-0x00007FFED5E05000-memory.dmp

Filesize
8KB

Download
memory/4920-22-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-23-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-24-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-25-0x0000000023E00000-0x0000000023E12000-memory.dmp

Filesize
72KB

Download
memory/4920-26-0x0000000025CC0000-0x0000000025F38000-memory.dmp

Filesize
2.5MB

Download
memory/4920-15-0x00007FFED5E03000-0x00007FFED5E05000-memory.dmp

Filesize
8KB

Download
memory/4920-35-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-36-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-40-0x0000000024E60000-0x0000000024F7E000-memory.dmp

Filesize
1.1MB

Download
memory/4920-14-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-13-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-12-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-11-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-10-0x000000001F010000-0x000000001F3D0000-memory.dmp

Filesize
3.8MB

Download
memory/4920-9-0x000000001EA20000-0x000000001F008000-memory.dmp

Filesize
5.9MB

Download
memory/4920-8-0x0000000005A60000-0x0000000005A72000-memory.dmp

Filesize
72KB

Download
memory/4920-3-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-2-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-1-0x00000000001A0000-0x000000000383E000-memory.dmp

Filesize
54.6MB

Download
memory/4920-83-0x00007FFED5E00000-0x00007FFED68C2000-memory.dmp

Filesize
10.8MB

Download