Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2023 09:20
Behavioral task
behavioral1
Sample
Bat_To_Exe_Converter.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
Bat_To_Exe_Converter.exe
Resource
win10-20230703-en
Behavioral task
behavioral3
Sample
Bat_To_Exe_Converter.exe
Resource
win10v2004-20230703-en
General
-
Target
Bat_To_Exe_Converter.exe
-
Size
267KB
-
MD5
4c8b09399380e02a5ec45eec25749cec
-
SHA1
36a2dbc5184edaa3f3b205a7c2ddf0ca4a4112ae
-
SHA256
99cb2f3bcdecd478de5ac0bd47297fc73356a094baa1d9ad806ae1e684cd4096
-
SHA512
bb6336caaf560b6df9b819882692104039620705affe252fe3c6146750bca97249e68f8e489729e347626f3597b049eed2b80aaf80441c3858f3938e5be9ca83
-
SSDEEP
6144:9JZKBI0RyYeY4eoiJ+sCFvyKj/LZZ3Ru79kkkkkkkkkkkkkkkkskkkkkkkkkkkkq:0yYrZos+xFvTRupkkkkkkkkkkkkkkkkZ
Malware Config
Signatures
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 7 IoCs
Processes:
resource yara_rule behavioral3/memory/1424-133-0x0000000000880000-0x00000000008CA000-memory.dmp vanillarat C:\Users\Admin\svchost.exe vanillarat C:\Users\Admin\svchost.exe vanillarat C:\Users\Admin\svchost.exe vanillarat behavioral3/memory/5024-166-0x0000000000CB0000-0x0000000000CD2000-memory.dmp vanillarat C:\Users\Admin\AppData\Roaming\svchost.exe vanillarat C:\Users\Admin\AppData\Roaming\svchost.exe vanillarat -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Bat_To_Exe_Converter.exesvchost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation Bat_To_Exe_Converter.exe Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 5024 svchost.exe 4940 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Bat_To_Exe_Converter.exesvchost.exedescription pid process Token: SeDebugPrivilege 1424 Bat_To_Exe_Converter.exe Token: SeDebugPrivilege 5024 svchost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Bat_To_Exe_Converter.exesvchost.exedescription pid process target process PID 1424 wrote to memory of 5024 1424 Bat_To_Exe_Converter.exe svchost.exe PID 1424 wrote to memory of 5024 1424 Bat_To_Exe_Converter.exe svchost.exe PID 1424 wrote to memory of 5024 1424 Bat_To_Exe_Converter.exe svchost.exe PID 5024 wrote to memory of 4940 5024 svchost.exe svchost.exe PID 5024 wrote to memory of 4940 5024 svchost.exe svchost.exe PID 5024 wrote to memory of 4940 5024 svchost.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bat_To_Exe_Converter.exe"C:\Users\Admin\AppData\Local\Temp\Bat_To_Exe_Converter.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\svchost.exe"C:\Users\Admin\svchost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
115KB
MD560693deb183633f99736c90e9469d405
SHA1f1dbd699f0d0694ccf54204f5894806d1eb5fa24
SHA25688375a89edfe2edc1032abc6acc7debf6c0df55b15b8b1c5dfe3655a303f5977
SHA5126cca558d8d4014adaab2ca67d7f932d42ff4f10ef857861ef6dc3d1f385c4767fa121e129ee5c957ced2fa0d2f175a1bc0b64d5c8b727cc3822da20bd92cf696
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
115KB
MD560693deb183633f99736c90e9469d405
SHA1f1dbd699f0d0694ccf54204f5894806d1eb5fa24
SHA25688375a89edfe2edc1032abc6acc7debf6c0df55b15b8b1c5dfe3655a303f5977
SHA5126cca558d8d4014adaab2ca67d7f932d42ff4f10ef857861ef6dc3d1f385c4767fa121e129ee5c957ced2fa0d2f175a1bc0b64d5c8b727cc3822da20bd92cf696
-
C:\Users\Admin\svchost.exeFilesize
115KB
MD560693deb183633f99736c90e9469d405
SHA1f1dbd699f0d0694ccf54204f5894806d1eb5fa24
SHA25688375a89edfe2edc1032abc6acc7debf6c0df55b15b8b1c5dfe3655a303f5977
SHA5126cca558d8d4014adaab2ca67d7f932d42ff4f10ef857861ef6dc3d1f385c4767fa121e129ee5c957ced2fa0d2f175a1bc0b64d5c8b727cc3822da20bd92cf696
-
C:\Users\Admin\svchost.exeFilesize
115KB
MD560693deb183633f99736c90e9469d405
SHA1f1dbd699f0d0694ccf54204f5894806d1eb5fa24
SHA25688375a89edfe2edc1032abc6acc7debf6c0df55b15b8b1c5dfe3655a303f5977
SHA5126cca558d8d4014adaab2ca67d7f932d42ff4f10ef857861ef6dc3d1f385c4767fa121e129ee5c957ced2fa0d2f175a1bc0b64d5c8b727cc3822da20bd92cf696
-
C:\Users\Admin\svchost.exeFilesize
115KB
MD560693deb183633f99736c90e9469d405
SHA1f1dbd699f0d0694ccf54204f5894806d1eb5fa24
SHA25688375a89edfe2edc1032abc6acc7debf6c0df55b15b8b1c5dfe3655a303f5977
SHA5126cca558d8d4014adaab2ca67d7f932d42ff4f10ef857861ef6dc3d1f385c4767fa121e129ee5c957ced2fa0d2f175a1bc0b64d5c8b727cc3822da20bd92cf696
-
memory/1424-133-0x0000000000880000-0x00000000008CA000-memory.dmpFilesize
296KB
-
memory/1424-134-0x00000000052A0000-0x000000000533C000-memory.dmpFilesize
624KB
-
memory/4940-181-0x000000000A510000-0x000000000A576000-memory.dmpFilesize
408KB
-
memory/5024-166-0x0000000000CB0000-0x0000000000CD2000-memory.dmpFilesize
136KB
-
memory/5024-167-0x00000000061B0000-0x0000000006754000-memory.dmpFilesize
5.6MB
-
memory/5024-168-0x0000000005CA0000-0x0000000005D32000-memory.dmpFilesize
584KB
-
memory/5024-169-0x0000000005C40000-0x0000000005C4A000-memory.dmpFilesize
40KB