vanillarat | 203b9d7b8796ea071beb263723991d57a40b25b77d0cbd2e4bd8dff62601331e

General

Target

TeamViewer_Setup.exe
Size

167KB
MD5

2240642fb1ec17326aba4bc86afecb30
SHA1

2601fb7ed63861ad837bc0b9a283f1230a295fb8
SHA256

203b9d7b8796ea071beb263723991d57a40b25b77d0cbd2e4bd8dff62601331e
SHA512

59f7a81a7db22c635a4c20baacf94c174f344762bff66bd2012b9ebf4012c6c4320c479340b34bd0f56d6a4acdc415d862468f909462f7113333a5c7a26ae0e3
SSDEEP

3072:SJZKnPE2YyJzELtyTtyYeY8lNgoiJ+sX8HFvytb4NQhjktOJ3Mz+:SJZKBI0tyYeY4eoiJ+sCFvXRW8z+

Score

10^/10

vanillarat persistence rat

Malware Config

Signatures

VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
rat vanillarat

Vanilla Rat payload 12 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2324-54-0x0000000001230000-0x0000000001262000-memory.dmp	vanillarat
\Windows\SysWOW64\dllhоst.exe	vanillarat
C:\Windows\SysWOW64\dllhоst.exe	vanillarat
C:\Windows\SysWOW64\dllhоst.exe	vanillarat
behavioral1/memory/1356-64-0x00000000001C0000-0x00000000001E8000-memory.dmp	vanillarat
behavioral1/memory/1356-66-0x0000000004CA0000-0x0000000004CE0000-memory.dmp	vanillarat
\Windows\SysWOW64\сsrss.exe	vanillarat
C:\Windows\SysWOW64\сsrss.exe	vanillarat
C:\Windows\SysWOW64\сsrss.exe	vanillarat
behavioral1/memory/3036-74-0x0000000000080000-0x00000000000A2000-memory.dmp	vanillarat
behavioral1/memory/3036-76-0x0000000004C40000-0x0000000004C80000-memory.dmp	vanillarat
behavioral1/memory/1356-78-0x0000000004CA0000-0x0000000004CE0000-memory.dmp	vanillarat

Executes dropped EXE 2 IoCs

Processes:

dllhоst.exeсsrss.exe

pid process

1356 dllhоst.exe
3036 сsrss.exe
Loads dropped DLL 2 IoCs

Processes:

TeamViewer_Setup.exedllhоst.exe

pid process

2324 TeamViewer_Setup.exe
1356 dllhоst.exe

pid	process
2324	TeamViewer_Setup.exe
1356	dllhоst.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Windows\\SysWOW64\\dllhоst.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Drops file in System32 directory 2 IoCs

Processes:

TeamViewer_Setup.exedllhоst.exe

description ioc process

File created C:\Windows\SysWOW64\dllhоst.exe TeamViewer_Setup.exe
File created C:\Windows\SysWOW64\сsrss.exe dllhоst.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2312 reg.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dllhоst.exe	TeamViewer_Setup.exe
File created	C:\Windows\SysWOW64\сsrss.exe	dllhоst.exe

pid	process
2312	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

dllhоst.exeсsrss.exe

pid	process
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
3036	сsrss.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe
1356	dllhоst.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

TeamViewer_Setup.exedllhоst.exeсsrss.exe

description pid process

Token: SeDebugPrivilege 2324 TeamViewer_Setup.exe
Token: SeDebugPrivilege 1356 dllhоst.exe
Token: SeDebugPrivilege 3036 сsrss.exe

description	pid	process
Token: SeDebugPrivilege	2324	TeamViewer_Setup.exe
Token: SeDebugPrivilege	1356	dllhоst.exe
Token: SeDebugPrivilege	3036	сsrss.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

TeamViewer_Setup.exedllhоst.exe

description	pid	process	target process
PID 2324 wrote to memory of 1356	2324	TeamViewer_Setup.exe	dllhоst.exe
PID 2324 wrote to memory of 1356	2324	TeamViewer_Setup.exe	dllhоst.exe
PID 2324 wrote to memory of 1356	2324	TeamViewer_Setup.exe	dllhоst.exe
PID 2324 wrote to memory of 1356	2324	TeamViewer_Setup.exe	dllhоst.exe
PID 1356 wrote to memory of 2312	1356	dllhоst.exe	reg.exe
PID 1356 wrote to memory of 2312	1356	dllhоst.exe	reg.exe
PID 1356 wrote to memory of 2312	1356	dllhоst.exe	reg.exe
PID 1356 wrote to memory of 2312	1356	dllhоst.exe	reg.exe
PID 1356 wrote to memory of 3036	1356	dllhоst.exe	сsrss.exe
PID 1356 wrote to memory of 3036	1356	dllhоst.exe	сsrss.exe
PID 1356 wrote to memory of 3036	1356	dllhоst.exe	сsrss.exe
PID 1356 wrote to memory of 3036	1356	dllhоst.exe	сsrss.exe

C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\dllhоst.exe
  "C:\Windows\System32\dllhоst.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Windows\SysWOW64\dllhоst.exe /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2312
- - C:\Windows\SysWOW64\сsrss.exe
    "C:\Windows\SysWOW64\сsrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Web Service

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\dllhоst.exe

Filesize
130KB

MD5
2bdc96dbce5e135529f676c6b88764c7

SHA1
580f2ab7c6f326c623bbd7ae4868f42daa0571e4

SHA256
a0ad6a336ea6eb88b3ee5c053ad14c6407de5baa3220bc66059d093e0d9d9ceb

SHA512
5682b35829f564ee41f8474288fd55e892373686c17084b10ee739e2dd0fa4d63a147a795f7f27ae32da599686d9458091b8a716272d5ad8d7fbe56b7c0cb453

Download Submit
C:\Windows\SysWOW64\dllhоst.exe

Filesize
130KB

MD5
2bdc96dbce5e135529f676c6b88764c7

SHA1
580f2ab7c6f326c623bbd7ae4868f42daa0571e4

SHA256
a0ad6a336ea6eb88b3ee5c053ad14c6407de5baa3220bc66059d093e0d9d9ceb

SHA512
5682b35829f564ee41f8474288fd55e892373686c17084b10ee739e2dd0fa4d63a147a795f7f27ae32da599686d9458091b8a716272d5ad8d7fbe56b7c0cb453

Download Submit
C:\Windows\SysWOW64\сsrss.exe

Filesize
115KB

MD5
baf28af74bec2fee218fc030c48ff403

SHA1
904379111848e20d2910e7122ea0713dc7dd76f4

SHA256
60ee28f72aad91470ce00cb75c029b0b2fbf440d734bdec00bd5bf8a6adfca5c

SHA512
6fcc43d6898a7e60a8c9ebdac31a4fc074ad0c20cbe4297b8d632ab653a01450a6b57cd43ae5126ff542517f1b6d43c56d62d23c863aa2e70650a9d265e6d081

Download Submit
C:\Windows\SysWOW64\сsrss.exe

Filesize
115KB

MD5
baf28af74bec2fee218fc030c48ff403

SHA1
904379111848e20d2910e7122ea0713dc7dd76f4

SHA256
60ee28f72aad91470ce00cb75c029b0b2fbf440d734bdec00bd5bf8a6adfca5c

SHA512
6fcc43d6898a7e60a8c9ebdac31a4fc074ad0c20cbe4297b8d632ab653a01450a6b57cd43ae5126ff542517f1b6d43c56d62d23c863aa2e70650a9d265e6d081

Download Submit
\Windows\SysWOW64\dllhоst.exe

Filesize
130KB

MD5
2bdc96dbce5e135529f676c6b88764c7

SHA1
580f2ab7c6f326c623bbd7ae4868f42daa0571e4

SHA256
a0ad6a336ea6eb88b3ee5c053ad14c6407de5baa3220bc66059d093e0d9d9ceb

SHA512
5682b35829f564ee41f8474288fd55e892373686c17084b10ee739e2dd0fa4d63a147a795f7f27ae32da599686d9458091b8a716272d5ad8d7fbe56b7c0cb453

Download Submit
\Windows\SysWOW64\сsrss.exe

Filesize
115KB

MD5
baf28af74bec2fee218fc030c48ff403

SHA1
904379111848e20d2910e7122ea0713dc7dd76f4

SHA256
60ee28f72aad91470ce00cb75c029b0b2fbf440d734bdec00bd5bf8a6adfca5c

SHA512
6fcc43d6898a7e60a8c9ebdac31a4fc074ad0c20cbe4297b8d632ab653a01450a6b57cd43ae5126ff542517f1b6d43c56d62d23c863aa2e70650a9d265e6d081

Download Submit
memory/1356-64-0x00000000001C0000-0x00000000001E8000-memory.dmp

Filesize
160KB

Download
memory/1356-77-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/1356-66-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/1356-63-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/1356-78-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/2324-54-0x0000000001230000-0x0000000001262000-memory.dmp

Filesize
200KB

Download
memory/2324-55-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/2324-65-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-74-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/3036-75-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-76-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download
memory/3036-79-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-80-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download
memory/3036-81-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads