vanillarat | ba380964a0905d9c84431100df8ed63f4f11c5e36a859d9c89e98fa5c75c2c5c

Analysis

max time kernel
148s
max time network
171s
platform
windows7_x64
resource
win7-20220414-en
submitted
25/05/2022, 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba380964a0905d9c84431100df8ed63f4f11c5e36a859d9c89e98fa5c75c2c5c.exe
Size

118KB
MD5

994b2e4e67a5c00676c603f7d5846a1d
SHA1

7977e2480736dcb8b2612054839ef8ac29b2bc9d
SHA256

ba380964a0905d9c84431100df8ed63f4f11c5e36a859d9c89e98fa5c75c2c5c
SHA512

7ace1c3b68d1fe0875e5fcbe5b378d1975a4ac4305ec62b8366af72e858251ab7dba0d28d18d818d2f7f349b28d4594a49903a6699c70a64662f1f4d6267f993

Score

10^/10

vanillarat persistence rat

Malware Config

Signatures

VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
rat vanillarat

Vanilla Rat Payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/800-54-0x0000000000E80000-0x0000000000EA4000-memory.dmp	vanillarat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\ba380964a0905d9c84431100df8ed63f4f11c5e36a859d9c89e98fa5c75c2c5c = "c:/Users/Admin/Windows"	ba380964a0905d9c84431100df8ed63f4f11c5e36a859d9c89e98fa5c75c2c5c.exe

C:\Users\Admin\AppData\Local\Temp\ba380964a0905d9c84431100df8ed63f4f11c5e36a859d9c89e98fa5c75c2c5c.exe
"C:\Users\Admin\AppData\Local\Temp\ba380964a0905d9c84431100df8ed63f4f11c5e36a859d9c89e98fa5c75c2c5c.exe"
1⤵
- Adds Run key to start application
PID:800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-54-0x0000000000E80000-0x0000000000EA4000-memory.dmp

Filesize
144KB

Download
memory/800-55-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download