vanillarat | e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81

Analysis

max time kernel
155s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
02-05-2022 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
Size

371KB
MD5

2d7a149c2065bf05c3d3fc056a80cd2b
SHA1

cec31a5b837314d47c911b96e44039b64f4831be
SHA256

e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81
SHA512

dff6515cdad12c2d65abcf20c707b058cb350caf419afd05f1e53e66c8d58b6cb8210ae59018d3667e0dbbad31816d8e170087735950f979841bf3376e778dae

Score

10^/10

vanillarat rat

Malware Config

Signatures

VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
rat vanillarat

Vanilla Rat Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3704-146-0x0000000000400000-0x0000000000422000-memory.dmp	vanillarat

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1812 set thread context of 2952	1812	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	81
PID 2952 set thread context of 2956	2952	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	82
PID 2956 set thread context of 4768	2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	84
PID 4768 set thread context of 4528	4768	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	85
PID 4528 set thread context of 4592	4528	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	86
PID 4592 set thread context of 3704	4592	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	87

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1812	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
1812	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
1812	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
Token: SeDebugPrivilege	2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2952	1812	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	81
PID 1812 wrote to memory of 2952	1812	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	81
PID 1812 wrote to memory of 2952	1812	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	81
PID 1812 wrote to memory of 2952	1812	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	81
PID 1812 wrote to memory of 2952	1812	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	81
PID 1812 wrote to memory of 2952	1812	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	81
PID 1812 wrote to memory of 2952	1812	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	81
PID 1812 wrote to memory of 2952	1812	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	81
PID 2952 wrote to memory of 2956	2952	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	82
PID 2952 wrote to memory of 2956	2952	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	82
PID 2952 wrote to memory of 2956	2952	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	82
PID 2952 wrote to memory of 2956	2952	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	82
PID 2952 wrote to memory of 2956	2952	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	82
PID 2952 wrote to memory of 2956	2952	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	82
PID 2952 wrote to memory of 2956	2952	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	82
PID 2952 wrote to memory of 2956	2952	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	82
PID 2956 wrote to memory of 332	2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	83
PID 2956 wrote to memory of 332	2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	83
PID 2956 wrote to memory of 332	2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	83
PID 2956 wrote to memory of 4768	2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	84
PID 2956 wrote to memory of 4768	2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	84
PID 2956 wrote to memory of 4768	2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	84
PID 2956 wrote to memory of 4768	2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	84
PID 2956 wrote to memory of 4768	2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	84
PID 2956 wrote to memory of 4768	2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	84
PID 2956 wrote to memory of 4768	2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	84
PID 2956 wrote to memory of 4768	2956	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	84
PID 4768 wrote to memory of 4528	4768	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	85
PID 4768 wrote to memory of 4528	4768	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	85
PID 4768 wrote to memory of 4528	4768	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	85
PID 4768 wrote to memory of 4528	4768	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	85
PID 4768 wrote to memory of 4528	4768	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	85
PID 4768 wrote to memory of 4528	4768	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	85
PID 4768 wrote to memory of 4528	4768	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	85
PID 4768 wrote to memory of 4528	4768	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	85
PID 4528 wrote to memory of 4592	4528	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	86
PID 4528 wrote to memory of 4592	4528	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	86
PID 4528 wrote to memory of 4592	4528	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	86
PID 4528 wrote to memory of 4592	4528	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	86
PID 4528 wrote to memory of 4592	4528	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	86
PID 4528 wrote to memory of 4592	4528	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	86
PID 4528 wrote to memory of 4592	4528	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	86
PID 4528 wrote to memory of 4592	4528	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	86
PID 4592 wrote to memory of 3704	4592	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	87
PID 4592 wrote to memory of 3704	4592	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	87
PID 4592 wrote to memory of 3704	4592	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	87
PID 4592 wrote to memory of 3704	4592	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	87
PID 4592 wrote to memory of 3704	4592	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	87
PID 4592 wrote to memory of 3704	4592	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	87
PID 4592 wrote to memory of 3704	4592	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	87
PID 4592 wrote to memory of 3704	4592	e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe	87

C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
"C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
  "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
    "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
      "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
      4⤵
      PID:332
  - - C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
      "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
        6⤵
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe"
        7⤵
        
        PID:3704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e3025b92ca323fe6dc93a50edd16f8e0fa66a29f3a74b70266a6fbb0bef6cc81.exe.log

Filesize
410B

MD5
24cfd42a8de70b38ed70e1f8cf4eda1c

SHA1
e447168fd38da9175084b36a06c3e9bbde99064c

SHA256
93b740416114e346878801c73e8a8670ff1390d3fa009424b88fafe614a3c5cd

SHA512
5c2daf5328ba99d750e9d0362e84f3a79b7fc8395aa8aa2bc1a01b266583fe1f8352bf0619f985aa72223412d14afa054537739b4941610a1d0f96e7fee2a875

Download Submit
memory/1812-131-0x000000000ADA0000-0x000000000B344000-memory.dmp

Filesize
5.6MB

Download
memory/1812-132-0x000000000A7F0000-0x000000000A882000-memory.dmp

Filesize
584KB

Download
memory/1812-130-0x00000000004D0000-0x0000000000536000-memory.dmp

Filesize
408KB

Download
memory/2952-134-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2956-136-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3704-146-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3704-147-0x0000000005360000-0x000000000536A000-memory.dmp

Filesize
40KB

Download
memory/4528-142-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4592-144-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4768-140-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download