Overview

overview

10

Static

static

10

TeamViewer_Setup.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09-07-2023 14:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TeamViewer_Setup.exe

  • Size

    152KB

  • MD5

    3854db59d8c7964dde765803e7e380b6

  • SHA1

    e5d981f6798cb902b7091944cdd7badafb7e0322

  • SHA256

    5a6dfde115172be8d295c748b4a681aabc1e7c105267e84e552c0c24518764df

  • SHA512

    3c239f667c92716ae6ac2e01cf208d18b4ab0eab61d776b757b151ff9899ba8648593c37b0b9f7c26f672255c07951b62b1cd1fb0ac84431f0aaf18690db83fa

  • SSDEEP

    3072:EJZKnPE2YyJzELtyTJyYeY8lNgoiJ+sX8HFvytbcNGInicz+:EJZKBI0JyYeY4eoiJ+sCFvPnNz+

Score
10/10
vanillaratpersistencerat

Malware Config

Signatures

  • VanillaRat

    VanillaRat is an advanced remote administration tool coded in C#.

    ratvanillarat
  • Vanilla Rat payload 7 IoCs
    rat
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3708
    • C:\Users\Admin\svchost.exe
      "C:\Users\Admin\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:3236
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 1436
      2⤵
      • Program crash
      PID:5012
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4032
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4940

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\svchost.exe
      Filesize

      115KB

      MD5

      99198c628ae018b8b7d043514141bded

      SHA1

      fa9b200d99530fb5efb36e7f928ad01f4dec5ed8

      SHA256

      160c2339126bc7800801d9d41d688f88d2d2656f711e8bc53a74fe179510e895

      SHA512

      0dd0f1210120d2a3838135f250460cac64ad50ee4d7393409923dadde0f8a791288ef0a2cba96e6b9ee8bb27e190b403d3c1dfd2f4a0e2262543100fdd404f4a

      Download Submit

    • C:\Users\Admin\AppData\Roaming\svchost.exe
      Filesize

      115KB

      MD5

      99198c628ae018b8b7d043514141bded

      SHA1

      fa9b200d99530fb5efb36e7f928ad01f4dec5ed8

      SHA256

      160c2339126bc7800801d9d41d688f88d2d2656f711e8bc53a74fe179510e895

      SHA512

      0dd0f1210120d2a3838135f250460cac64ad50ee4d7393409923dadde0f8a791288ef0a2cba96e6b9ee8bb27e190b403d3c1dfd2f4a0e2262543100fdd404f4a

      Download Submit

    • C:\Users\Admin\AppData\Roaming\svchost.exe
      Filesize

      115KB

      MD5

      99198c628ae018b8b7d043514141bded

      SHA1

      fa9b200d99530fb5efb36e7f928ad01f4dec5ed8

      SHA256

      160c2339126bc7800801d9d41d688f88d2d2656f711e8bc53a74fe179510e895

      SHA512

      0dd0f1210120d2a3838135f250460cac64ad50ee4d7393409923dadde0f8a791288ef0a2cba96e6b9ee8bb27e190b403d3c1dfd2f4a0e2262543100fdd404f4a

      Download Submit

    • C:\Users\Admin\svchost.exe
      Filesize

      115KB

      MD5

      99198c628ae018b8b7d043514141bded

      SHA1

      fa9b200d99530fb5efb36e7f928ad01f4dec5ed8

      SHA256

      160c2339126bc7800801d9d41d688f88d2d2656f711e8bc53a74fe179510e895

      SHA512

      0dd0f1210120d2a3838135f250460cac64ad50ee4d7393409923dadde0f8a791288ef0a2cba96e6b9ee8bb27e190b403d3c1dfd2f4a0e2262543100fdd404f4a

      Download Submit

    • C:\Users\Admin\svchost.exe
      Filesize

      115KB

      MD5

      99198c628ae018b8b7d043514141bded

      SHA1

      fa9b200d99530fb5efb36e7f928ad01f4dec5ed8

      SHA256

      160c2339126bc7800801d9d41d688f88d2d2656f711e8bc53a74fe179510e895

      SHA512

      0dd0f1210120d2a3838135f250460cac64ad50ee4d7393409923dadde0f8a791288ef0a2cba96e6b9ee8bb27e190b403d3c1dfd2f4a0e2262543100fdd404f4a

      Download Submit

    • memory/3236-139-0x0000000005600000-0x0000000005700000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3236-138-0x0000000009840000-0x00000000098A6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/3236-137-0x0000000005600000-0x0000000005700000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3708-120-0x00000000003A0000-0x00000000003CE000-memory.dmp

      Filesize

      184KB

      Download

    • memory/4800-127-0x0000000000D50000-0x0000000000D72000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4800-131-0x0000000003470000-0x000000000347A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4800-130-0x0000000005D00000-0x0000000005E00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4800-129-0x0000000005A40000-0x0000000005AD2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4800-128-0x0000000006200000-0x00000000066FE000-memory.dmp

      Filesize

      5.0MB

      Download