Analysis
- max time kernel
128s - max time network
127s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
22/11/2021, 07:24
General
- Target 1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe
- Size 139KB
- Sample211122-h8jklsaaa4
- SHA256 1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517
Score
10/10
Malware Config
Signatures
- VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
- Vanilla Rat Payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe"C:\Users\Admin\AppData\Local\Temp\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe"C:\Users\Admin\AppData\Roaming\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2788-115-0x00000000004E0000-0x00000000004E1000-memory.dmp
memory/2788-117-0x0000000005340000-0x0000000005341000-memory.dmp
memory/2788-118-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/2788-119-0x0000000004E40000-0x000000000533E000-memory.dmp
memory/2788-120-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/3528-129-0x0000000005510000-0x0000000005511000-memory.dmp
memory/3528-130-0x0000000009A10000-0x0000000009A11000-memory.dmp
memory/3528-131-0x0000000005511000-0x0000000005512000-memory.dmp