Analysis
- max time kernel
149s - max time network
142s - platform
windows7_x64 - resource
win7-20230712-en - resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system - submitted
17/07/2023, 10:58
Behavioral task
behavioral1
Sample
TeamViewer_Setup.exe
Resource
win7-20230712-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
TeamViewer_Setup.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target TeamViewer_Setup.exe
- Size 167KB
- Sample230717-m2tjfsbd28
- SHA256 203b9d7b8796ea071beb263723991d57a40b25b77d0cbd2e4bd8dff62601331e
- MD5 2240642fb1ec17326aba4bc86afecb30
- SHA1 2601fb7ed63861ad837bc0b9a283f1230a295fb8
- SHA512 59f7a81a7db22c635a4c20baacf94c174f344762bff66bd2012b9ebf4012c6c4320c479340b34bd0f56d6a4acdc415d862468f909462f7113333a5c7a26ae0e3
- SSDEEP 3072:SJZKnPE2YyJzELtyTtyYeY8lNgoiJ+sX8HFvytb4NQhjktOJ3Mz+:SJZKBI0tyYeY4eoiJ+sCFvXRW8z+
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
- Vanilla Rat payload 12 IoCs
resource yara_rule behavioral1/memory/2324-54-0x0000000001230000-0x0000000001262000-memory.dmp vanillarat behavioral1/files/0x0008000000012028-58.dat vanillarat behavioral1/files/0x0008000000012028-62.dat vanillarat behavioral1/files/0x0008000000012028-61.dat vanillarat behavioral1/memory/1356-64-0x00000000001C0000-0x00000000001E8000-memory.dmp vanillarat behavioral1/memory/1356-66-0x0000000004CA0000-0x0000000004CE0000-memory.dmp vanillarat behavioral1/files/0x000a0000000139d3-69.dat vanillarat behavioral1/files/0x000a0000000139d3-72.dat vanillarat behavioral1/files/0x000a0000000139d3-73.dat vanillarat behavioral1/memory/3036-74-0x0000000000080000-0x00000000000A2000-memory.dmp vanillarat behavioral1/memory/3036-76-0x0000000004C40000-0x0000000004C80000-memory.dmp vanillarat behavioral1/memory/1356-78-0x0000000004CA0000-0x0000000004CE0000-memory.dmp vanillarat - Executes dropped EXE 2 IoCs
pid Process 1356 dllhоst.exe 3036 сsrss.exe - Loads dropped DLL 2 IoCs
pid Process 2324 TeamViewer_Setup.exe 1356 dllhоst.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Windows\\SysWOW64\\dllhоst.exe" reg.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dllhоst.exe TeamViewer_Setup.exe File created C:\Windows\SysWOW64\сsrss.exe dllhоst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry key 1 TTPs 1 IoCs
pid Process 2312 reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 3036 сsrss.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe 1356 dllhоst.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2324 TeamViewer_Setup.exe Token: SeDebugPrivilege 1356 dllhоst.exe Token: SeDebugPrivilege 3036 сsrss.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2324 wrote to memory of 1356 2324 TeamViewer_Setup.exe 29 PID 2324 wrote to memory of 1356 2324 TeamViewer_Setup.exe 29 PID 2324 wrote to memory of 1356 2324 TeamViewer_Setup.exe 29 PID 2324 wrote to memory of 1356 2324 TeamViewer_Setup.exe 29 PID 1356 wrote to memory of 2312 1356 dllhоst.exe 30 PID 1356 wrote to memory of 2312 1356 dllhоst.exe 30 PID 1356 wrote to memory of 2312 1356 dllhоst.exe 30 PID 1356 wrote to memory of 2312 1356 dllhоst.exe 30 PID 1356 wrote to memory of 3036 1356 dllhоst.exe 32 PID 1356 wrote to memory of 3036 1356 dllhоst.exe 32 PID 1356 wrote to memory of 3036 1356 dllhоst.exe 32 PID 1356 wrote to memory of 3036 1356 dllhоst.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\dllhоst.exe"C:\Windows\System32\dllhоst.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Windows\SysWOW64\dllhоst.exe /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:2312
-
-
C:\Windows\SysWOW64\сsrss.exe"C:\Windows\SysWOW64\сsrss.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\dllhоst.exe
- Size 130KB
- SHA256 a0ad6a336ea6eb88b3ee5c053ad14c6407de5baa3220bc66059d093e0d9d9ceb
- MD5 2bdc96dbce5e135529f676c6b88764c7
- SHA1 580f2ab7c6f326c623bbd7ae4868f42daa0571e4
- SHA512 5682b35829f564ee41f8474288fd55e892373686c17084b10ee739e2dd0fa4d63a147a795f7f27ae32da599686d9458091b8a716272d5ad8d7fbe56b7c0cb453
- SSDEEP 3072:vJZKnPE2YyJzELtyTtyYeY8lNgoiJ+sX8HFvytb4NQhjkt:vJZKBI0tyYeY4eoiJ+sCFvXR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\dllhоst.exe
- Size 130KB
- SHA256 a0ad6a336ea6eb88b3ee5c053ad14c6407de5baa3220bc66059d093e0d9d9ceb
- MD5 2bdc96dbce5e135529f676c6b88764c7
- SHA1 580f2ab7c6f326c623bbd7ae4868f42daa0571e4
- SHA512 5682b35829f564ee41f8474288fd55e892373686c17084b10ee739e2dd0fa4d63a147a795f7f27ae32da599686d9458091b8a716272d5ad8d7fbe56b7c0cb453
- SSDEEP 3072:vJZKnPE2YyJzELtyTtyYeY8lNgoiJ+sX8HFvytb4NQhjkt:vJZKBI0tyYeY4eoiJ+sCFvXR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\сsrss.exe
- Size 115KB
- SHA256 60ee28f72aad91470ce00cb75c029b0b2fbf440d734bdec00bd5bf8a6adfca5c
- MD5 baf28af74bec2fee218fc030c48ff403
- SHA1 904379111848e20d2910e7122ea0713dc7dd76f4
- SHA512 6fcc43d6898a7e60a8c9ebdac31a4fc074ad0c20cbe4297b8d632ab653a01450a6b57cd43ae5126ff542517f1b6d43c56d62d23c863aa2e70650a9d265e6d081
- SSDEEP 3072:hJZKnPE2YyJzELtyTtyYeY8lNgoiJ+sX8HFvytb4NQ:hJZKBI0tyYeY4eoiJ+sCFvX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\сsrss.exe
- Size 115KB
- SHA256 60ee28f72aad91470ce00cb75c029b0b2fbf440d734bdec00bd5bf8a6adfca5c
- MD5 baf28af74bec2fee218fc030c48ff403
- SHA1 904379111848e20d2910e7122ea0713dc7dd76f4
- SHA512 6fcc43d6898a7e60a8c9ebdac31a4fc074ad0c20cbe4297b8d632ab653a01450a6b57cd43ae5126ff542517f1b6d43c56d62d23c863aa2e70650a9d265e6d081
- SSDEEP 3072:hJZKnPE2YyJzELtyTtyYeY8lNgoiJ+sX8HFvytb4NQ:hJZKBI0tyYeY4eoiJ+sCFvX
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\SysWOW64\dllhоst.exe
- Size 130KB
- SHA256 a0ad6a336ea6eb88b3ee5c053ad14c6407de5baa3220bc66059d093e0d9d9ceb
- MD5 2bdc96dbce5e135529f676c6b88764c7
- SHA1 580f2ab7c6f326c623bbd7ae4868f42daa0571e4
- SHA512 5682b35829f564ee41f8474288fd55e892373686c17084b10ee739e2dd0fa4d63a147a795f7f27ae32da599686d9458091b8a716272d5ad8d7fbe56b7c0cb453
- SSDEEP 3072:vJZKnPE2YyJzELtyTtyYeY8lNgoiJ+sX8HFvytb4NQhjkt:vJZKBI0tyYeY4eoiJ+sCFvXR
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\SysWOW64\сsrss.exe
- Size 115KB
- SHA256 60ee28f72aad91470ce00cb75c029b0b2fbf440d734bdec00bd5bf8a6adfca5c
- MD5 baf28af74bec2fee218fc030c48ff403
- SHA1 904379111848e20d2910e7122ea0713dc7dd76f4
- SHA512 6fcc43d6898a7e60a8c9ebdac31a4fc074ad0c20cbe4297b8d632ab653a01450a6b57cd43ae5126ff542517f1b6d43c56d62d23c863aa2e70650a9d265e6d081
- SSDEEP 3072:hJZKnPE2YyJzELtyTtyYeY8lNgoiJ+sX8HFvytb4NQ:hJZKBI0tyYeY4eoiJ+sCFvX
- MD5 SHA1 SHA512 SSDEEP