File name:

sorgu panel ekip.exe

Full analysis: https://app.any.run/tasks/de9cc5dd-75d5-477a-97d8-8ebbbefdba3e
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: January 20, 2024, 22:01:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
asyncrat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

DCA3D1845E7E2B0CDFB7C6F2B663CF75

SHA1:

930FD608D6E1F95A84382F30E937CA8F46AB9D20

SHA256:

DE8E89B4BA655F8222FC7C90F23C6978ABE7C221C301FE3840A2201834DBEB2B

SSDEEP:

1536:TBWwhwwhjVhV8bzGHIf1U4XOBpbAv63bCXBPVvk+kTmZx:TBWwhwwhjVhBHI0I63bCPzx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • sorgu panel ekip.exe (PID: 124)

    • ASYNCRAT has been detected (YARA)

      • panel.exe (PID: 2076)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • sorgu panel ekip.exe (PID: 124)

    • Executing commands from a ".bat" file

      • sorgu panel ekip.exe (PID: 124)

    • Executable content was dropped or overwritten

      • sorgu panel ekip.exe (PID: 124)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 392)

    • The executable file from the user directory is run by the CMD process

      • panel.exe (PID: 2076)

  • INFO

    • Reads the machine GUID from the registry

      • sorgu panel ekip.exe (PID: 124)
      • panel.exe (PID: 2076)

    • Reads the computer name

      • sorgu panel ekip.exe (PID: 124)
      • panel.exe (PID: 2076)

    • Checks supported languages

      • sorgu panel ekip.exe (PID: 124)
      • panel.exe (PID: 2076)

    • Creates files or folders in the user directory

      • sorgu panel ekip.exe (PID: 124)

    • Create files in a temporary directory

      • sorgu panel ekip.exe (PID: 124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(2076) panel.exe
C2 (1)127.0.0.1
Ports (3)6606
7707
8808
BotnetDefault
Version0.5.8
Options
AutoRuntrue
MutexKtm7Jx89Ep9O
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE7jCCAtagAwIBAgIQAN+MreZbBc4dCG4RhTKolTANBgkqhkiG9w0BAQ0FADAYMRYwFAYDVQQDDA1DaWhhZCBDaGFubmVsMCAXDTIzMTExNTE4MjIyMFoYDzk5OTkxMjMxMjM1OTU5WjAYMRYwFAYDVQQDDA1DaWhhZCBDaGFubmVsMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0VySuxtKj83xknI/VqH4BsgdK5vJu7wO4IWtVi2QZEvXfi5ssjc/ZPDxMG4+GS7gY+2x/mzGyj5sWH9E...
Server_SignatureUxorCJFE03QuzGvOZkBwuBcX3/DCLFOhJEYFfpI64MKMlA3fC3KR5jb+WTIuyvhF6TZsG9Yiz3B3UeeyZwR08EGu7kTQ8R/2jslXi/Vt1+mFSz/JK/GJXaSxnB+UvYHef1zg6Ujv2iKTQ+r90Bru2Sx/m8ANk2CTQGnRUXNqIrSxHiEzZTESCN8iNnH6auNMtxNQA4Uml07mB1LI0+x9WMXDhlczSHrUUTu2e0QwoTuFVvHM6Ug7Oob0iVzhYZCrUzQAOE/8HNrqIf1OlGyts8cbeHYX0U8aqpywzmmnXdHF...
Keys
AES86da0e3fd9c916dede6b674644e8e7a8021ca7b8a13e71f3ad0e5b8b1a3a69b8
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:16 23:40:53+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 43008
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0xc6de
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: Stub.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: Stub.exe
ProductName: -
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sorgu panel ekip.exe cmd.exe no specs timeout.exe no specs #ASYNCRAT panel.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Users\admin\AppData\Local\Temp\sorgu panel ekip.exe" C:\Users\admin\AppData\Local\Temp\sorgu panel ekip.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\sorgu panel ekip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
392C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmp338.tmp.bat""C:\Windows\System32\cmd.exe—sorgu panel ekip.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2076"C:\Users\admin\AppData\Roaming\panel.exe" C:\Users\admin\AppData\Roaming\panel.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\panel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
AsyncRat
(PID) Process(2076) panel.exe
C2 (1)127.0.0.1
Ports (3)6606
7707
8808
BotnetDefault
Version0.5.8
Options
AutoRuntrue
MutexKtm7Jx89Ep9O
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE7jCCAtagAwIBAgIQAN+MreZbBc4dCG4RhTKolTANBgkqhkiG9w0BAQ0FADAYMRYwFAYDVQQDDA1DaWhhZCBDaGFubmVsMCAXDTIzMTExNTE4MjIyMFoYDzk5OTkxMjMxMjM1OTU5WjAYMRYwFAYDVQQDDA1DaWhhZCBDaGFubmVsMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0VySuxtKj83xknI/VqH4BsgdK5vJu7wO4IWtVi2QZEvXfi5ssjc/ZPDxMG4+GS7gY+2x/mzGyj5sWH9E...
Server_SignatureUxorCJFE03QuzGvOZkBwuBcX3/DCLFOhJEYFfpI64MKMlA3fC3KR5jb+WTIuyvhF6TZsG9Yiz3B3UeeyZwR08EGu7kTQ8R/2jslXi/Vt1+mFSz/JK/GJXaSxnB+UvYHef1zg6Ujv2iKTQ+r90Bru2Sx/m8ANk2CTQGnRUXNqIrSxHiEzZTESCN8iNnH6auNMtxNQA4Uml07mB1LI0+x9WMXDhlczSHrUUTu2e0QwoTuFVvHM6Ug7Oob0iVzhYZCrUzQAOE/8HNrqIf1OlGyts8cbeHYX0U8aqpywzmmnXdHF...
Keys
AES86da0e3fd9c916dede6b674644e8e7a8021ca7b8a13e71f3ad0e5b8b1a3a69b8
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
2088timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
Total events
593
Read events
565
Write events
28
Delete events
0

Modification events

(PID) Process:(124) sorgu panel ekip.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2076) panel.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
124sorgu panel ekip.exeC:\Users\admin\AppData\Roaming\panel.exeexecutable
MD5:DCA3D1845E7E2B0CDFB7C6F2B663CF75
SHA256:DE8E89B4BA655F8222FC7C90F23C6978ABE7C221C301FE3840A2201834DBEB2B
124sorgu panel ekip.exeC:\Users\admin\AppData\Local\Temp\tmp338.tmp.battext
MD5:131452F9CF05485E6BFD58000EC2604A
SHA256:BDB02DEE9F1F380A36ADB3E214A3E699ACCB2D475ACA6FB4154E845EBA066C4D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
sorgu panel ekip.exe