Overview

overview

10

Static

static

53c91d4d30...a3.exe

windows7_x64

10

53c91d4d30...a3.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-05-2022 15:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe

  • Size

    258KB

  • MD5

    3e12aad4f4408afe6575ca90a6da61fc

  • SHA1

    445f1a34c24a71eb86f1bc8a8fd71759248cbf73

  • SHA256

    53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3

  • SHA512

    304b11841b5424001095b18003a90f236f0ec1b27ed595c5d1f180fb24f1888e02e96ff1a3658fa54ea3d6409504db596457abe14b880d0120d79ed46e32d3e1

Score
10/10
vanillaratrat

Malware Config

Signatures

  • VanillaRat

    VanillaRat is an advanced remote administration tool coded in C#.

    ratvanillarat
  • Vanilla Rat Payload 1 IoCs
    rat
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
    "C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:672
    • C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
      "C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
        "C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3776
        • C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
          "C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3384
          • C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
            "C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe"
            5⤵
              PID:4872
            • C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
              "C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe"
              5⤵
                PID:1488

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe.log
        Filesize

        410B

        MD5

        24cfd42a8de70b38ed70e1f8cf4eda1c

        SHA1

        e447168fd38da9175084b36a06c3e9bbde99064c

        SHA256

        93b740416114e346878801c73e8a8670ff1390d3fa009424b88fafe614a3c5cd

        SHA512

        5c2daf5328ba99d750e9d0362e84f3a79b7fc8395aa8aa2bc1a01b266583fe1f8352bf0619f985aa72223412d14afa054537739b4941610a1d0f96e7fee2a875

        Download Submit
      • memory/672-130-0x0000000000070000-0x00000000000B6000-memory.dmp
        Filesize

        280KB

        Download
      • memory/672-131-0x00000000050A0000-0x0000000005644000-memory.dmp
        Filesize

        5.6MB

        Download
      • memory/672-132-0x0000000004B90000-0x0000000004C22000-memory.dmp
        Filesize

        584KB

        Download
      • memory/1488-143-0x0000000003320000-0x000000000332A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/1488-141-0x0000000000000000-mapping.dmp
        Download
      • memory/1488-142-0x0000000000400000-0x0000000000422000-memory.dmp
        Filesize

        136KB

        Download
      • memory/2288-133-0x0000000000000000-mapping.dmp
        Download
      • memory/2288-134-0x0000000000400000-0x0000000000434000-memory.dmp
        Filesize

        208KB

        Download
      • memory/3384-138-0x0000000000000000-mapping.dmp
        Download
      • memory/3384-139-0x0000000000400000-0x0000000000428000-memory.dmp
        Filesize

        160KB

        Download
      • memory/3776-136-0x0000000000000000-mapping.dmp
        Download
      • memory/3776-137-0x0000000000400000-0x000000000042E000-memory.dmp
        Filesize

        184KB

        Download
      • memory/4872-140-0x0000000000000000-mapping.dmp
        Download