Analysis
-
max time kernel
126s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2022 07:04
Behavioral task
behavioral1
Sample
GTA 5 - FREE COPY .exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
600 seconds
General
-
Target
GTA 5 - FREE COPY .exe
-
Size
114KB
-
MD5
185526401b0a3a083c797cac3598051a
-
SHA1
a3a4c4fd2b7f07843e0ac8eeb62b2c8871421b4f
-
SHA256
caba6c8f198ca5ec08ece1687210e756b860c90ecc32b49ef38a1a7d14524abe
-
SHA512
ea4f5e217be971950a05bd096dd526f40958ed2b92cbc62a21a83d258b665f35b13b32809b9cf4751887c743e1f58aaebecfab5c3b6ac1ed8e5bd968187adf3f
-
SSDEEP
3072:xgFtDHh9m0xajuYXPiKo3s+DXgHKv8mbIXC0LtyTy:aFRh9mEaKHS+DeKvYSE0
Score
10/10
Malware Config
Signatures
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 1 IoCs
resource yara_rule behavioral1/memory/4332-132-0x0000000000610000-0x0000000000632000-memory.dmp vanillarat -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1704 taskmgr.exe Token: SeSystemProfilePrivilege 1704 taskmgr.exe Token: SeCreateGlobalPrivilege 1704 taskmgr.exe Token: 33 1704 taskmgr.exe Token: SeIncBasePriorityPrivilege 1704 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GTA 5 - FREE COPY .exe"C:\Users\Admin\AppData\Local\Temp\GTA 5 - FREE COPY .exe"1⤵PID:4332
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1704
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1312