vanillarat | 0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e

Analysis

max time kernel
155s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
02-05-2022 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe
Size

282KB
MD5

0344bf2e7a272c184e0399ccd77b980c
SHA1

262e95e1fa85e7b46517c983bd552ad3df5f7c1b
SHA256

0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e
SHA512

b0d105f5bf1e89d7425c07e021e58bbc514ddfec6f2b0d854f4f660195848c5c9df151ae111d0fb5255a87eb54c94e140d553e84ef4b95e72b5275d858a8195f

Score

10^/10

vanillarat rat

Malware Config

Signatures

VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
rat vanillarat

Vanilla Rat Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/436-143-0x0000000000400000-0x0000000000422000-memory.dmp	vanillarat

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2236 set thread context of 4168	2236	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	82
PID 4168 set thread context of 4540	4168	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	83
PID 4540 set thread context of 3360	4540	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	84
PID 3360 set thread context of 4580	3360	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	85
PID 4580 set thread context of 436	4580	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	86

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4168	2236	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	82
PID 2236 wrote to memory of 4168	2236	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	82
PID 2236 wrote to memory of 4168	2236	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	82
PID 2236 wrote to memory of 4168	2236	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	82
PID 2236 wrote to memory of 4168	2236	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	82
PID 2236 wrote to memory of 4168	2236	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	82
PID 2236 wrote to memory of 4168	2236	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	82
PID 2236 wrote to memory of 4168	2236	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	82
PID 4168 wrote to memory of 4540	4168	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	83
PID 4168 wrote to memory of 4540	4168	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	83
PID 4168 wrote to memory of 4540	4168	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	83
PID 4168 wrote to memory of 4540	4168	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	83
PID 4168 wrote to memory of 4540	4168	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	83
PID 4168 wrote to memory of 4540	4168	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	83
PID 4168 wrote to memory of 4540	4168	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	83
PID 4168 wrote to memory of 4540	4168	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	83
PID 4540 wrote to memory of 3360	4540	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	84
PID 4540 wrote to memory of 3360	4540	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	84
PID 4540 wrote to memory of 3360	4540	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	84
PID 4540 wrote to memory of 3360	4540	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	84
PID 4540 wrote to memory of 3360	4540	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	84
PID 4540 wrote to memory of 3360	4540	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	84
PID 4540 wrote to memory of 3360	4540	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	84
PID 4540 wrote to memory of 3360	4540	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	84
PID 3360 wrote to memory of 4580	3360	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	85
PID 3360 wrote to memory of 4580	3360	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	85
PID 3360 wrote to memory of 4580	3360	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	85
PID 3360 wrote to memory of 4580	3360	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	85
PID 3360 wrote to memory of 4580	3360	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	85
PID 3360 wrote to memory of 4580	3360	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	85
PID 3360 wrote to memory of 4580	3360	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	85
PID 3360 wrote to memory of 4580	3360	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	85
PID 4580 wrote to memory of 436	4580	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	86
PID 4580 wrote to memory of 436	4580	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	86
PID 4580 wrote to memory of 436	4580	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	86
PID 4580 wrote to memory of 436	4580	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	86
PID 4580 wrote to memory of 436	4580	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	86
PID 4580 wrote to memory of 436	4580	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	86
PID 4580 wrote to memory of 436	4580	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	86
PID 4580 wrote to memory of 436	4580	0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe	86

C:\Users\Admin\AppData\Local\Temp\0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe
"C:\Users\Admin\AppData\Local\Temp\0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe
  "C:\Users\Admin\AppData\Local\Temp\0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Users\Admin\AppData\Local\Temp\0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe
    "C:\Users\Admin\AppData\Local\Temp\0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe
      "C:\Users\Admin\AppData\Local\Temp\0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe"
        6⤵
        
        PID:436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0e9179dbbdcb9a49cefbdc6d709f54d07205bd7cdb1d1aa295654f3a54da8d8e.exe.log

Filesize
410B

MD5
24cfd42a8de70b38ed70e1f8cf4eda1c

SHA1
e447168fd38da9175084b36a06c3e9bbde99064c

SHA256
93b740416114e346878801c73e8a8670ff1390d3fa009424b88fafe614a3c5cd

SHA512
5c2daf5328ba99d750e9d0362e84f3a79b7fc8395aa8aa2bc1a01b266583fe1f8352bf0619f985aa72223412d14afa054537739b4941610a1d0f96e7fee2a875

Download Submit
memory/436-144-0x0000000004F30000-0x0000000004F3A000-memory.dmp

Filesize
40KB

Download
memory/436-143-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2236-131-0x0000000005270000-0x0000000005814000-memory.dmp

Filesize
5.6MB

Download
memory/2236-132-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Filesize
584KB

Download
memory/2236-130-0x00000000003F0000-0x000000000043C000-memory.dmp

Filesize
304KB

Download
memory/3360-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4168-134-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4540-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4580-141-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads