Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
17-07-2023 10:58
Behavioral task
behavioral1
Sample
TeamViewer_Setup.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
TeamViewer_Setup.exe
Resource
win10v2004-20230703-en
General
-
Target
TeamViewer_Setup.exe
-
Size
167KB
-
MD5
2240642fb1ec17326aba4bc86afecb30
-
SHA1
2601fb7ed63861ad837bc0b9a283f1230a295fb8
-
SHA256
203b9d7b8796ea071beb263723991d57a40b25b77d0cbd2e4bd8dff62601331e
-
SHA512
59f7a81a7db22c635a4c20baacf94c174f344762bff66bd2012b9ebf4012c6c4320c479340b34bd0f56d6a4acdc415d862468f909462f7113333a5c7a26ae0e3
-
SSDEEP
3072:SJZKnPE2YyJzELtyTtyYeY8lNgoiJ+sX8HFvytb4NQhjktOJ3Mz+:SJZKBI0tyYeY4eoiJ+sCFvXRW8z+
Malware Config
Signatures
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 12 IoCs
Processes:
resource yara_rule behavioral1/memory/2324-54-0x0000000001230000-0x0000000001262000-memory.dmp vanillarat \Windows\SysWOW64\dllhоst.exe vanillarat C:\Windows\SysWOW64\dllhоst.exe vanillarat C:\Windows\SysWOW64\dllhоst.exe vanillarat behavioral1/memory/1356-64-0x00000000001C0000-0x00000000001E8000-memory.dmp vanillarat behavioral1/memory/1356-66-0x0000000004CA0000-0x0000000004CE0000-memory.dmp vanillarat \Windows\SysWOW64\сsrss.exe vanillarat C:\Windows\SysWOW64\сsrss.exe vanillarat C:\Windows\SysWOW64\сsrss.exe vanillarat behavioral1/memory/3036-74-0x0000000000080000-0x00000000000A2000-memory.dmp vanillarat behavioral1/memory/3036-76-0x0000000004C40000-0x0000000004C80000-memory.dmp vanillarat behavioral1/memory/1356-78-0x0000000004CA0000-0x0000000004CE0000-memory.dmp vanillarat -
Executes dropped EXE 2 IoCs
Processes:
dllhоst.exeсsrss.exepid process 1356 dllhоst.exe 3036 сsrss.exe -
Loads dropped DLL 2 IoCs
Processes:
TeamViewer_Setup.exedllhоst.exepid process 2324 TeamViewer_Setup.exe 1356 dllhоst.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Windows\\SysWOW64\\dllhоst.exe" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
TeamViewer_Setup.exedllhоst.exedescription ioc process File created C:\Windows\SysWOW64\dllhоst.exe TeamViewer_Setup.exe File created C:\Windows\SysWOW64\сsrss.exe dllhоst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dllhоst.exeсsrss.exepid process 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 3036 сsrss.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
TeamViewer_Setup.exedllhоst.exeсsrss.exedescription pid process Token: SeDebugPrivilege 2324 TeamViewer_Setup.exe Token: SeDebugPrivilege 1356 dllhоst.exe Token: SeDebugPrivilege 3036 сsrss.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
TeamViewer_Setup.exedllhоst.exedescription pid process target process PID 2324 wrote to memory of 1356 2324 TeamViewer_Setup.exe dllhоst.exe PID 2324 wrote to memory of 1356 2324 TeamViewer_Setup.exe dllhоst.exe PID 2324 wrote to memory of 1356 2324 TeamViewer_Setup.exe dllhоst.exe PID 2324 wrote to memory of 1356 2324 TeamViewer_Setup.exe dllhоst.exe PID 1356 wrote to memory of 2312 1356 dllhоst.exe reg.exe PID 1356 wrote to memory of 2312 1356 dllhоst.exe reg.exe PID 1356 wrote to memory of 2312 1356 dllhоst.exe reg.exe PID 1356 wrote to memory of 2312 1356 dllhоst.exe reg.exe PID 1356 wrote to memory of 3036 1356 dllhоst.exe сsrss.exe PID 1356 wrote to memory of 3036 1356 dllhоst.exe сsrss.exe PID 1356 wrote to memory of 3036 1356 dllhоst.exe сsrss.exe PID 1356 wrote to memory of 3036 1356 dllhоst.exe сsrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhоst.exe"C:\Windows\System32\dllhоst.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Windows\SysWOW64\dllhоst.exe /f3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\сsrss.exe"C:\Windows\SysWOW64\сsrss.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\dllhоst.exeFilesize
130KB
MD52bdc96dbce5e135529f676c6b88764c7
SHA1580f2ab7c6f326c623bbd7ae4868f42daa0571e4
SHA256a0ad6a336ea6eb88b3ee5c053ad14c6407de5baa3220bc66059d093e0d9d9ceb
SHA5125682b35829f564ee41f8474288fd55e892373686c17084b10ee739e2dd0fa4d63a147a795f7f27ae32da599686d9458091b8a716272d5ad8d7fbe56b7c0cb453
-
C:\Windows\SysWOW64\dllhоst.exeFilesize
130KB
MD52bdc96dbce5e135529f676c6b88764c7
SHA1580f2ab7c6f326c623bbd7ae4868f42daa0571e4
SHA256a0ad6a336ea6eb88b3ee5c053ad14c6407de5baa3220bc66059d093e0d9d9ceb
SHA5125682b35829f564ee41f8474288fd55e892373686c17084b10ee739e2dd0fa4d63a147a795f7f27ae32da599686d9458091b8a716272d5ad8d7fbe56b7c0cb453
-
C:\Windows\SysWOW64\сsrss.exeFilesize
115KB
MD5baf28af74bec2fee218fc030c48ff403
SHA1904379111848e20d2910e7122ea0713dc7dd76f4
SHA25660ee28f72aad91470ce00cb75c029b0b2fbf440d734bdec00bd5bf8a6adfca5c
SHA5126fcc43d6898a7e60a8c9ebdac31a4fc074ad0c20cbe4297b8d632ab653a01450a6b57cd43ae5126ff542517f1b6d43c56d62d23c863aa2e70650a9d265e6d081
-
C:\Windows\SysWOW64\сsrss.exeFilesize
115KB
MD5baf28af74bec2fee218fc030c48ff403
SHA1904379111848e20d2910e7122ea0713dc7dd76f4
SHA25660ee28f72aad91470ce00cb75c029b0b2fbf440d734bdec00bd5bf8a6adfca5c
SHA5126fcc43d6898a7e60a8c9ebdac31a4fc074ad0c20cbe4297b8d632ab653a01450a6b57cd43ae5126ff542517f1b6d43c56d62d23c863aa2e70650a9d265e6d081
-
\Windows\SysWOW64\dllhоst.exeFilesize
130KB
MD52bdc96dbce5e135529f676c6b88764c7
SHA1580f2ab7c6f326c623bbd7ae4868f42daa0571e4
SHA256a0ad6a336ea6eb88b3ee5c053ad14c6407de5baa3220bc66059d093e0d9d9ceb
SHA5125682b35829f564ee41f8474288fd55e892373686c17084b10ee739e2dd0fa4d63a147a795f7f27ae32da599686d9458091b8a716272d5ad8d7fbe56b7c0cb453
-
\Windows\SysWOW64\сsrss.exeFilesize
115KB
MD5baf28af74bec2fee218fc030c48ff403
SHA1904379111848e20d2910e7122ea0713dc7dd76f4
SHA25660ee28f72aad91470ce00cb75c029b0b2fbf440d734bdec00bd5bf8a6adfca5c
SHA5126fcc43d6898a7e60a8c9ebdac31a4fc074ad0c20cbe4297b8d632ab653a01450a6b57cd43ae5126ff542517f1b6d43c56d62d23c863aa2e70650a9d265e6d081
-
memory/1356-64-0x00000000001C0000-0x00000000001E8000-memory.dmpFilesize
160KB
-
memory/1356-77-0x0000000074750000-0x0000000074E3E000-memory.dmpFilesize
6.9MB
-
memory/1356-66-0x0000000004CA0000-0x0000000004CE0000-memory.dmpFilesize
256KB
-
memory/1356-63-0x0000000074750000-0x0000000074E3E000-memory.dmpFilesize
6.9MB
-
memory/1356-78-0x0000000004CA0000-0x0000000004CE0000-memory.dmpFilesize
256KB
-
memory/2324-54-0x0000000001230000-0x0000000001262000-memory.dmpFilesize
200KB
-
memory/2324-55-0x0000000074750000-0x0000000074E3E000-memory.dmpFilesize
6.9MB
-
memory/2324-65-0x0000000074750000-0x0000000074E3E000-memory.dmpFilesize
6.9MB
-
memory/3036-74-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/3036-75-0x0000000074750000-0x0000000074E3E000-memory.dmpFilesize
6.9MB
-
memory/3036-76-0x0000000004C40000-0x0000000004C80000-memory.dmpFilesize
256KB
-
memory/3036-79-0x0000000074750000-0x0000000074E3E000-memory.dmpFilesize
6.9MB
-
memory/3036-80-0x0000000004C40000-0x0000000004C80000-memory.dmpFilesize
256KB
-
memory/3036-81-0x0000000004C40000-0x0000000004C80000-memory.dmpFilesize
256KB