vanillarat | 53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3

Analysis

max time kernel
151s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
02-05-2022 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
Size

258KB
MD5

3e12aad4f4408afe6575ca90a6da61fc
SHA1

445f1a34c24a71eb86f1bc8a8fd71759248cbf73
SHA256

53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3
SHA512

304b11841b5424001095b18003a90f236f0ec1b27ed595c5d1f180fb24f1888e02e96ff1a3658fa54ea3d6409504db596457abe14b880d0120d79ed46e32d3e1

Score

10^/10

vanillarat rat

Malware Config

Signatures

VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
rat vanillarat

Vanilla Rat Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1488-142-0x0000000000400000-0x0000000000422000-memory.dmp	vanillarat

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 672 set thread context of 2288	672	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	81
PID 2288 set thread context of 3776	2288	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	82
PID 3776 set thread context of 3384	3776	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	83
PID 3384 set thread context of 1488	3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 2288	672	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	81
PID 672 wrote to memory of 2288	672	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	81
PID 672 wrote to memory of 2288	672	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	81
PID 672 wrote to memory of 2288	672	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	81
PID 672 wrote to memory of 2288	672	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	81
PID 672 wrote to memory of 2288	672	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	81
PID 672 wrote to memory of 2288	672	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	81
PID 672 wrote to memory of 2288	672	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	81
PID 2288 wrote to memory of 3776	2288	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	82
PID 2288 wrote to memory of 3776	2288	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	82
PID 2288 wrote to memory of 3776	2288	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	82
PID 2288 wrote to memory of 3776	2288	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	82
PID 2288 wrote to memory of 3776	2288	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	82
PID 2288 wrote to memory of 3776	2288	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	82
PID 2288 wrote to memory of 3776	2288	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	82
PID 2288 wrote to memory of 3776	2288	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	82
PID 3776 wrote to memory of 3384	3776	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	83
PID 3776 wrote to memory of 3384	3776	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	83
PID 3776 wrote to memory of 3384	3776	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	83
PID 3776 wrote to memory of 3384	3776	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	83
PID 3776 wrote to memory of 3384	3776	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	83
PID 3776 wrote to memory of 3384	3776	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	83
PID 3776 wrote to memory of 3384	3776	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	83
PID 3776 wrote to memory of 3384	3776	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	83
PID 3384 wrote to memory of 4872	3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	84
PID 3384 wrote to memory of 4872	3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	84
PID 3384 wrote to memory of 4872	3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	84
PID 3384 wrote to memory of 1488	3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	85
PID 3384 wrote to memory of 1488	3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	85
PID 3384 wrote to memory of 1488	3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	85
PID 3384 wrote to memory of 1488	3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	85
PID 3384 wrote to memory of 1488	3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	85
PID 3384 wrote to memory of 1488	3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	85
PID 3384 wrote to memory of 1488	3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	85
PID 3384 wrote to memory of 1488	3384	53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe	85

C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
"C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:672
- C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
  "C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
    "C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
      "C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe"
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe"
        5⤵
        
        PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\53c91d4d304d2063c2020291e3ab11312b3e2e7bad3c99f8fb01b1a5776465a3.exe.log

Filesize
410B

MD5
24cfd42a8de70b38ed70e1f8cf4eda1c

SHA1
e447168fd38da9175084b36a06c3e9bbde99064c

SHA256
93b740416114e346878801c73e8a8670ff1390d3fa009424b88fafe614a3c5cd

SHA512
5c2daf5328ba99d750e9d0362e84f3a79b7fc8395aa8aa2bc1a01b266583fe1f8352bf0619f985aa72223412d14afa054537739b4941610a1d0f96e7fee2a875

Download Submit
memory/672-130-0x0000000000070000-0x00000000000B6000-memory.dmp

Filesize
280KB

Download
memory/672-131-0x00000000050A0000-0x0000000005644000-memory.dmp

Filesize
5.6MB

Download
memory/672-132-0x0000000004B90000-0x0000000004C22000-memory.dmp

Filesize
584KB

Download
memory/1488-143-0x0000000003320000-0x000000000332A000-memory.dmp

Filesize
40KB

Download
memory/1488-142-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2288-134-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3384-139-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3776-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download