Analysis
-
max time kernel
1049s -
max time network
1053s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-06-2023 17:11
Behavioral task
behavioral1
Sample
test2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
test2.exe
Resource
win10v2004-20230220-en
General
-
Target
test2.exe
-
Size
114KB
-
MD5
816dcb73aaa3ef2dafcd7dfba38ff5de
-
SHA1
8a0d7402fe3624d0fa27c3bfd08066f19d71f2a3
-
SHA256
9513a8b064250a333c2f0b87f00dbfedef65585e5d0c9c7295c7cc75e52407fa
-
SHA512
a9e44071779a5b49a0922012f7991f6cd2ea1d420e4640d82310c7d0b41e210000c8b73e3f8676cd47936e6b7156944cf7674138e4077cb252b32c2068a98d5f
-
SSDEEP
3072:ogZApdYrD28fbJB2yLtyT8bjjxK3QdjrxivW+DXnH4vymb41b:o/pe1J08bXtrxivW+D34ve
Malware Config
Signatures
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1484-54-0x00000000000E0000-0x0000000000102000-memory.dmp vanillarat \Users\Admin\AppData\Roaming\test2.exe vanillarat C:\Users\Admin\AppData\Roaming\test2.exe vanillarat C:\Users\Admin\AppData\Roaming\test2.exe vanillarat behavioral1/memory/1728-63-0x00000000013D0000-0x00000000013F2000-memory.dmp vanillarat behavioral1/memory/1728-64-0x0000000000440000-0x0000000000480000-memory.dmp vanillarat -
Executes dropped EXE 1 IoCs
Processes:
test2.exepid process 1728 test2.exe -
Loads dropped DLL 1 IoCs
Processes:
test2.exepid process 1484 test2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
test2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\test2 = "C:\\Users\\Admin\\AppData\\Roaming\\test2.exe" test2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
test2.exedescription pid process Token: SeDebugPrivilege 1484 test2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
test2.exedescription pid process target process PID 1484 wrote to memory of 1728 1484 test2.exe test2.exe PID 1484 wrote to memory of 1728 1484 test2.exe test2.exe PID 1484 wrote to memory of 1728 1484 test2.exe test2.exe PID 1484 wrote to memory of 1728 1484 test2.exe test2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\test2.exe"C:\Users\Admin\AppData\Local\Temp\test2.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Roaming\test2.exe"C:\Users\Admin\AppData\Roaming\test2.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1728
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\test2.exeFilesize
114KB
MD5816dcb73aaa3ef2dafcd7dfba38ff5de
SHA18a0d7402fe3624d0fa27c3bfd08066f19d71f2a3
SHA2569513a8b064250a333c2f0b87f00dbfedef65585e5d0c9c7295c7cc75e52407fa
SHA512a9e44071779a5b49a0922012f7991f6cd2ea1d420e4640d82310c7d0b41e210000c8b73e3f8676cd47936e6b7156944cf7674138e4077cb252b32c2068a98d5f
-
C:\Users\Admin\AppData\Roaming\test2.exeFilesize
114KB
MD5816dcb73aaa3ef2dafcd7dfba38ff5de
SHA18a0d7402fe3624d0fa27c3bfd08066f19d71f2a3
SHA2569513a8b064250a333c2f0b87f00dbfedef65585e5d0c9c7295c7cc75e52407fa
SHA512a9e44071779a5b49a0922012f7991f6cd2ea1d420e4640d82310c7d0b41e210000c8b73e3f8676cd47936e6b7156944cf7674138e4077cb252b32c2068a98d5f
-
\Users\Admin\AppData\Roaming\test2.exeFilesize
114KB
MD5816dcb73aaa3ef2dafcd7dfba38ff5de
SHA18a0d7402fe3624d0fa27c3bfd08066f19d71f2a3
SHA2569513a8b064250a333c2f0b87f00dbfedef65585e5d0c9c7295c7cc75e52407fa
SHA512a9e44071779a5b49a0922012f7991f6cd2ea1d420e4640d82310c7d0b41e210000c8b73e3f8676cd47936e6b7156944cf7674138e4077cb252b32c2068a98d5f
-
memory/1484-54-0x00000000000E0000-0x0000000000102000-memory.dmpFilesize
136KB
-
memory/1484-55-0x0000000004E80000-0x0000000004EC0000-memory.dmpFilesize
256KB
-
memory/1728-63-0x00000000013D0000-0x00000000013F2000-memory.dmpFilesize
136KB
-
memory/1728-64-0x0000000000440000-0x0000000000480000-memory.dmpFilesize
256KB