Analysis
-
max time kernel
67s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 17:11
Behavioral task
behavioral1
Sample
test2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
test2.exe
Resource
win10v2004-20230220-en
General
-
Target
test2.exe
-
Size
114KB
-
MD5
816dcb73aaa3ef2dafcd7dfba38ff5de
-
SHA1
8a0d7402fe3624d0fa27c3bfd08066f19d71f2a3
-
SHA256
9513a8b064250a333c2f0b87f00dbfedef65585e5d0c9c7295c7cc75e52407fa
-
SHA512
a9e44071779a5b49a0922012f7991f6cd2ea1d420e4640d82310c7d0b41e210000c8b73e3f8676cd47936e6b7156944cf7674138e4077cb252b32c2068a98d5f
-
SSDEEP
3072:ogZApdYrD28fbJB2yLtyT8bjjxK3QdjrxivW+DXnH4vymb41b:o/pe1J08bXtrxivW+D34ve
Malware Config
Signatures
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2772-133-0x00000000000C0000-0x00000000000E2000-memory.dmp vanillarat C:\Users\Admin\AppData\Roaming\test2.exe vanillarat C:\Users\Admin\AppData\Roaming\test2.exe vanillarat C:\Users\Admin\AppData\Roaming\test2.exe vanillarat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
test2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation test2.exe -
Executes dropped EXE 1 IoCs
Processes:
test2.exepid process 3960 test2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
test2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\test2 = "C:\\Users\\Admin\\AppData\\Roaming\\test2.exe" test2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
test2.exedescription pid process Token: SeDebugPrivilege 2772 test2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
test2.exedescription pid process target process PID 2772 wrote to memory of 3960 2772 test2.exe test2.exe PID 2772 wrote to memory of 3960 2772 test2.exe test2.exe PID 2772 wrote to memory of 3960 2772 test2.exe test2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\test2.exe"C:\Users\Admin\AppData\Local\Temp\test2.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\test2.exe"C:\Users\Admin\AppData\Roaming\test2.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\test2.exeFilesize
114KB
MD5816dcb73aaa3ef2dafcd7dfba38ff5de
SHA18a0d7402fe3624d0fa27c3bfd08066f19d71f2a3
SHA2569513a8b064250a333c2f0b87f00dbfedef65585e5d0c9c7295c7cc75e52407fa
SHA512a9e44071779a5b49a0922012f7991f6cd2ea1d420e4640d82310c7d0b41e210000c8b73e3f8676cd47936e6b7156944cf7674138e4077cb252b32c2068a98d5f
-
C:\Users\Admin\AppData\Roaming\test2.exeFilesize
114KB
MD5816dcb73aaa3ef2dafcd7dfba38ff5de
SHA18a0d7402fe3624d0fa27c3bfd08066f19d71f2a3
SHA2569513a8b064250a333c2f0b87f00dbfedef65585e5d0c9c7295c7cc75e52407fa
SHA512a9e44071779a5b49a0922012f7991f6cd2ea1d420e4640d82310c7d0b41e210000c8b73e3f8676cd47936e6b7156944cf7674138e4077cb252b32c2068a98d5f
-
C:\Users\Admin\AppData\Roaming\test2.exeFilesize
114KB
MD5816dcb73aaa3ef2dafcd7dfba38ff5de
SHA18a0d7402fe3624d0fa27c3bfd08066f19d71f2a3
SHA2569513a8b064250a333c2f0b87f00dbfedef65585e5d0c9c7295c7cc75e52407fa
SHA512a9e44071779a5b49a0922012f7991f6cd2ea1d420e4640d82310c7d0b41e210000c8b73e3f8676cd47936e6b7156944cf7674138e4077cb252b32c2068a98d5f
-
memory/2772-133-0x00000000000C0000-0x00000000000E2000-memory.dmpFilesize
136KB
-
memory/2772-134-0x0000000005090000-0x0000000005634000-memory.dmpFilesize
5.6MB
-
memory/2772-135-0x0000000004AE0000-0x0000000004B72000-memory.dmpFilesize
584KB
-
memory/2772-136-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/2772-137-0x0000000004AB0000-0x0000000004ABA000-memory.dmpFilesize
40KB
-
memory/3960-149-0x0000000005B50000-0x0000000005B60000-memory.dmpFilesize
64KB
-
memory/3960-150-0x0000000009790000-0x00000000097F6000-memory.dmpFilesize
408KB