Analysis
-
max time kernel
128s -
max time network
127s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
22-11-2021 07:24
Static task
static1
Behavioral task
behavioral1
Sample
1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe
Resource
win10-en-20211014
General
-
Target
1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe
-
Size
139KB
-
MD5
24498ef58f4b76004f41963465e9785a
-
SHA1
4c05441356ef77d59d93e0b623229b910aafc052
-
SHA256
1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517
-
SHA512
103a622c5dd70823bf92f79f794943e17129556b89533bb5ca537402ff30f0c2236d0f595ae401a5d81d436b109eb07f0333c6e1f148897a5c50f7efcdf292b6
Malware Config
Signatures
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe vanillarat C:\Users\Admin\AppData\Roaming\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe vanillarat -
Executes dropped EXE 1 IoCs
Processes:
1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exepid process 3528 1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517 = "C:\\Users\\Admin\\AppData\\Roaming\\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe" 1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exedescription pid process Token: SeDebugPrivilege 2788 1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exedescription pid process target process PID 2788 wrote to memory of 3528 2788 1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe 1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe PID 2788 wrote to memory of 3528 2788 1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe 1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe PID 2788 wrote to memory of 3528 2788 1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe 1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe"C:\Users\Admin\AppData\Local\Temp\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe"C:\Users\Admin\AppData\Roaming\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exeMD5
24498ef58f4b76004f41963465e9785a
SHA14c05441356ef77d59d93e0b623229b910aafc052
SHA2561ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517
SHA512103a622c5dd70823bf92f79f794943e17129556b89533bb5ca537402ff30f0c2236d0f595ae401a5d81d436b109eb07f0333c6e1f148897a5c50f7efcdf292b6
-
C:\Users\Admin\AppData\Roaming\1ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517.exeMD5
24498ef58f4b76004f41963465e9785a
SHA14c05441356ef77d59d93e0b623229b910aafc052
SHA2561ba043db198ade08d2945c34900a4e2e643137953e240ed6289f2d66b5cfc517
SHA512103a622c5dd70823bf92f79f794943e17129556b89533bb5ca537402ff30f0c2236d0f595ae401a5d81d436b109eb07f0333c6e1f148897a5c50f7efcdf292b6
-
memory/2788-115-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/2788-117-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/2788-118-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/2788-119-0x0000000004E40000-0x000000000533E000-memory.dmpFilesize
5.0MB
-
memory/2788-120-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/3528-121-0x0000000000000000-mapping.dmp
-
memory/3528-129-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/3528-130-0x0000000009A10000-0x0000000009A11000-memory.dmpFilesize
4KB
-
memory/3528-131-0x0000000005511000-0x0000000005512000-memory.dmpFilesize
4KB