Overview

overview

10

Static

static

e3025b92ca...81.exe

windows7_x64

5

e3025b92ca...81.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    155s
  • max time network
    186s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-05-2022 15:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe

  • Size

    371KB

  • MD5

    2d7a149c2065bf05c3d3fc056a80cd2b

  • SHA1

    cec31a5b837314d47c911b96e44039b64f4831be

  • SHA256

    e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81

  • SHA512

    dff6515cdad12c2d65abcf20c707b058cb350caf419afd05f1e53e66c8d58b6cb8210ae59018d3667e0dbbad31816d8e170087735950f979841bf3376e778dae

Score
10/10
vanillaratrat

Malware Config

Signatures

  • VanillaRat

    VanillaRat is an advanced remote administration tool coded in C#.

    ratvanillarat
  • Vanilla Rat Payload 1 IoCs
    rat
  • Suspicious use of SetThreadContext 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
    "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
      "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
        "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2956
        • C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
          "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
          4⤵
            PID:332
          • C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
            "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
            4⤵
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4768
            • C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
              "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:4528
              • C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
                "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
                6⤵
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4592
                • C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
                  "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
                  7⤵
                    PID:3704

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe.log
        Filesize

        410B

        MD5

        24cfd42a8de70b38ed70e1f8cf4eda1c

        SHA1

        e447168fd38da9175084b36a06c3e9bbde99064c

        SHA256

        93b740416114e346878801c73e8a8670ff1390d3fa009424b88fafe614a3c5cd

        SHA512

        5c2daf5328ba99d750e9d0362e84f3a79b7fc8395aa8aa2bc1a01b266583fe1f8352bf0619f985aa72223412d14afa054537739b4941610a1d0f96e7fee2a875

        Download Submit
      • memory/332-138-0x0000000000000000-mapping.dmp
        Download
      • memory/1812-131-0x000000000ADA0000-0x000000000B344000-memory.dmp
        Filesize

        5.6MB

        Download
      • memory/1812-132-0x000000000A7F0000-0x000000000A882000-memory.dmp
        Filesize

        584KB

        Download
      • memory/1812-130-0x00000000004D0000-0x0000000000536000-memory.dmp
        Filesize

        408KB

        Download
      • memory/2952-134-0x0000000000400000-0x000000000044C000-memory.dmp
        Filesize

        304KB

        Download
      • memory/2952-133-0x0000000000000000-mapping.dmp
        Download
      • memory/2956-136-0x0000000000400000-0x000000000043A000-memory.dmp
        Filesize

        232KB

        Download
      • memory/2956-135-0x0000000000000000-mapping.dmp
        Download
      • memory/3704-145-0x0000000000000000-mapping.dmp
        Download
      • memory/3704-146-0x0000000000400000-0x0000000000422000-memory.dmp
        Filesize

        136KB

        Download
      • memory/3704-147-0x0000000005360000-0x000000000536A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/4528-142-0x0000000000400000-0x000000000042E000-memory.dmp
        Filesize

        184KB

        Download
      • memory/4528-141-0x0000000000000000-mapping.dmp
        Download
      • memory/4592-143-0x0000000000000000-mapping.dmp
        Download
      • memory/4592-144-0x0000000000400000-0x0000000000428000-memory.dmp
        Filesize

        160KB

        Download
      • memory/4768-139-0x0000000000000000-mapping.dmp
        Download
      • memory/4768-140-0x0000000000400000-0x0000000000434000-memory.dmp
        Filesize

        208KB

        Download