Analysis
-
max time kernel
136s -
max time network
144s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
29-09-2022 15:35
General
-
Target
ChargedX.exe
-
Size
114KB
-
MD5
ad85ed21df04fce7ed4f2408d26293e2
-
SHA1
094218ae33d2365863e3a769ccde906ada17097c
-
SHA256
384dbb34a249b4cfa399f6835ff9d08063f87eda81ba5c4eccdf491c22ce25bf
-
SHA512
ac763da457ea03f43c12b9d62e2a72dc7f7683dce27647772b24783a0eb6d1d7c6b8d93b7472b039ff55e0e70b9dd25bad85ea73055fade174aa9dba64ccea0c
-
SSDEEP
3072:PgZApdYrD28fbJB2yLtyTUbjjxK3QdjrxivW+DXnH4vymbT1U:P/pe1J0UbXtrxivW+D34v3
Malware Config
Signatures
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ChargedX.exe"C:\Users\Admin\AppData\Local\Temp\ChargedX.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ChargedX.exe"C:\Users\Admin\AppData\Roaming\ChargedX.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD5ad85ed21df04fce7ed4f2408d26293e2
SHA1094218ae33d2365863e3a769ccde906ada17097c
SHA256384dbb34a249b4cfa399f6835ff9d08063f87eda81ba5c4eccdf491c22ce25bf
SHA512ac763da457ea03f43c12b9d62e2a72dc7f7683dce27647772b24783a0eb6d1d7c6b8d93b7472b039ff55e0e70b9dd25bad85ea73055fade174aa9dba64ccea0c
-
Filesize
114KB
MD5ad85ed21df04fce7ed4f2408d26293e2
SHA1094218ae33d2365863e3a769ccde906ada17097c
SHA256384dbb34a249b4cfa399f6835ff9d08063f87eda81ba5c4eccdf491c22ce25bf
SHA512ac763da457ea03f43c12b9d62e2a72dc7f7683dce27647772b24783a0eb6d1d7c6b8d93b7472b039ff55e0e70b9dd25bad85ea73055fade174aa9dba64ccea0c
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
136KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
5.0MB
-
Filesize
1.6MB
-
Filesize
584KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
40KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-