Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-05-2022 18:31
Static task
static1
Behavioral task
behavioral1
Sample
3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe
Resource
win10v2004-20220414-en
General
-
Target
3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe
-
Size
216KB
-
MD5
7d5130b3d2921ce20b1ff6015c63ac7b
-
SHA1
6533edb2384541c31cdd08734e39b22e8815c861
-
SHA256
3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49
-
SHA512
7ac7ee838584b5cf0857e855c1ef821e46c4246ba41a366285c4cd46d30f60bf742ad9eec72a38e7b9fed50e69abb406fc0ba83ac324c8a98df0e4ac2010430f
Malware Config
Signatures
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1784-72-0x0000000000400000-0x0000000000422000-memory.dmp vanillarat behavioral1/memory/1784-73-0x0000000000400000-0x0000000000422000-memory.dmp vanillarat behavioral1/memory/1784-71-0x0000000000400000-0x0000000000422000-memory.dmp vanillarat behavioral1/memory/1784-74-0x000000000041DC1E-mapping.dmp vanillarat behavioral1/memory/1784-76-0x0000000000400000-0x0000000000422000-memory.dmp vanillarat behavioral1/memory/1784-78-0x0000000000400000-0x0000000000422000-memory.dmp vanillarat -
Suspicious use of SetThreadContext 2 IoCs
Processes:
3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exedescription pid process target process PID 1652 set thread context of 1316 1652 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1316 set thread context of 1784 1316 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exedescription pid process target process PID 1652 wrote to memory of 1316 1652 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1652 wrote to memory of 1316 1652 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1652 wrote to memory of 1316 1652 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1652 wrote to memory of 1316 1652 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1652 wrote to memory of 1316 1652 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1652 wrote to memory of 1316 1652 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1652 wrote to memory of 1316 1652 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1652 wrote to memory of 1316 1652 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1652 wrote to memory of 1316 1652 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1316 wrote to memory of 1784 1316 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1316 wrote to memory of 1784 1316 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1316 wrote to memory of 1784 1316 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1316 wrote to memory of 1784 1316 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1316 wrote to memory of 1784 1316 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1316 wrote to memory of 1784 1316 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1316 wrote to memory of 1784 1316 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1316 wrote to memory of 1784 1316 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe PID 1316 wrote to memory of 1784 1316 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe 3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe"C:\Users\Admin\AppData\Local\Temp\3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe"C:\Users\Admin\AppData\Local\Temp\3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe"C:\Users\Admin\AppData\Local\Temp\3e2edb8f934920d1f71052fc4a13ca3a159ce56ddaa14e60822c236675cd3b49.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1316-67-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1316-65-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1316-57-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1316-58-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1316-60-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1316-61-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1316-63-0x0000000000423B0E-mapping.dmp
-
memory/1316-62-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1652-56-0x0000000000310000-0x000000000031A000-memory.dmpFilesize
40KB
-
memory/1652-54-0x0000000001260000-0x00000000012A0000-memory.dmpFilesize
256KB
-
memory/1652-55-0x00000000001F0000-0x00000000001F6000-memory.dmpFilesize
24KB
-
memory/1784-76-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1784-72-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1784-73-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1784-71-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1784-68-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1784-74-0x000000000041DC1E-mapping.dmp
-
memory/1784-69-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1784-78-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1784-79-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB