Analysis
-
max time kernel
109s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
25-01-2023 04:55
General
-
Target
user-PC.exe
-
Size
114KB
-
MD5
13339515c6424f70fdfcbfa1d5f22cba
-
SHA1
24947a5af2576155e13b2af69337d645ccd9ccff
-
SHA256
5457e63322d9eed080807b8fcc91bf1db6b71418f9f56a28a1f77e3de2e9053f
-
SHA512
f49203cd23e7ee614d1ab89453d29e02e93c0e0814eff27c841b825493ca3842dd88861769df87c9c7df31b568f46eba56f833c0622a7d85556c3bc522740544
-
SSDEEP
3072:EgZApdYrD28fbJB2yLtyTkbjjxK3QdjrxivW+DXnH4vymbs1j:E/pe1J0kbXtrxivW+D34vq
Malware Config
Signatures
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\user-PC.exe"C:\Users\Admin\AppData\Local\Temp\user-PC.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\user-PC.exe"C:\Users\Admin\AppData\Roaming\user-PC.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\user-PC.exeFilesize
114KB
MD513339515c6424f70fdfcbfa1d5f22cba
SHA124947a5af2576155e13b2af69337d645ccd9ccff
SHA2565457e63322d9eed080807b8fcc91bf1db6b71418f9f56a28a1f77e3de2e9053f
SHA512f49203cd23e7ee614d1ab89453d29e02e93c0e0814eff27c841b825493ca3842dd88861769df87c9c7df31b568f46eba56f833c0622a7d85556c3bc522740544
-
C:\Users\Admin\AppData\Roaming\user-PC.exeFilesize
114KB
MD513339515c6424f70fdfcbfa1d5f22cba
SHA124947a5af2576155e13b2af69337d645ccd9ccff
SHA2565457e63322d9eed080807b8fcc91bf1db6b71418f9f56a28a1f77e3de2e9053f
SHA512f49203cd23e7ee614d1ab89453d29e02e93c0e0814eff27c841b825493ca3842dd88861769df87c9c7df31b568f46eba56f833c0622a7d85556c3bc522740544
-
memory/3916-136-0x0000000000000000-mapping.dmp
-
memory/4644-132-0x00000000005F0000-0x0000000000612000-memory.dmpFilesize
136KB
-
memory/4644-133-0x0000000005620000-0x0000000005BC4000-memory.dmpFilesize
5.6MB
-
memory/4644-134-0x0000000004FC0000-0x0000000005052000-memory.dmpFilesize
584KB
-
memory/4644-135-0x0000000005080000-0x000000000508A000-memory.dmpFilesize
40KB