vanillarat | 203b9d7b8796ea071beb263723991d57a40b25b77d0cbd2e4bd8dff62601331e

General

Target

TeamViewer_Setup.exe
Size

167KB
MD5

2240642fb1ec17326aba4bc86afecb30
SHA1

2601fb7ed63861ad837bc0b9a283f1230a295fb8
SHA256

203b9d7b8796ea071beb263723991d57a40b25b77d0cbd2e4bd8dff62601331e
SHA512

59f7a81a7db22c635a4c20baacf94c174f344762bff66bd2012b9ebf4012c6c4320c479340b34bd0f56d6a4acdc415d862468f909462f7113333a5c7a26ae0e3
SSDEEP

3072:SJZKnPE2YyJzELtyTtyYeY8lNgoiJ+sX8HFvytb4NQhjktOJ3Mz+:SJZKBI0tyYeY4eoiJ+sCFvXRW8z+

Score

10^/10

vanillarat persistence rat

Malware Config

Signatures

VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
rat vanillarat

Vanilla Rat payload 11 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1908-134-0x0000000000050000-0x0000000000082000-memory.dmp	vanillarat
C:\Windows\SysWOW64\dllhоst.exe	vanillarat
C:\Windows\SysWOW64\dllhоst.exe	vanillarat
C:\Windows\SysWOW64\dllhоst.exe	vanillarat
behavioral2/memory/4476-147-0x00000000002D0000-0x00000000002F8000-memory.dmp	vanillarat
behavioral2/memory/4476-153-0x0000000004EA0000-0x0000000004EB0000-memory.dmp	vanillarat
C:\Windows\SysWOW64\сsrss.exe	vanillarat
C:\Windows\SysWOW64\сsrss.exe	vanillarat
C:\Windows\SysWOW64\сsrss.exe	vanillarat
behavioral2/memory/1204-167-0x00000000003A0000-0x00000000003C2000-memory.dmp	vanillarat
behavioral2/memory/1204-169-0x0000000004C60000-0x0000000004C70000-memory.dmp	vanillarat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TeamViewer_Setup.exedllhоst.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	TeamViewer_Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	dllhоst.exe

Executes dropped EXE 2 IoCs

Processes:

dllhоst.exeсsrss.exe

pid process

4476 dllhоst.exe
1204 сsrss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Windows\\SysWOW64\\dllhоst.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Drops file in System32 directory 2 IoCs

Processes:

TeamViewer_Setup.exedllhоst.exe

description ioc process

File created C:\Windows\SysWOW64\dllhоst.exe TeamViewer_Setup.exe
File created C:\Windows\SysWOW64\сsrss.exe dllhоst.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3600 reg.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dllhоst.exe	TeamViewer_Setup.exe
File created	C:\Windows\SysWOW64\сsrss.exe	dllhоst.exe

pid	process
3600	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

dllhоst.exe

pid	process
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe
4476	dllhоst.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

TeamViewer_Setup.exedllhоst.exe

description pid process

Token: SeDebugPrivilege 1908 TeamViewer_Setup.exe
Token: SeDebugPrivilege 4476 dllhоst.exe

description	pid	process
Token: SeDebugPrivilege	1908	TeamViewer_Setup.exe
Token: SeDebugPrivilege	4476	dllhоst.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

TeamViewer_Setup.exedllhоst.exe

description	pid	process	target process
PID 1908 wrote to memory of 4476	1908	TeamViewer_Setup.exe	dllhоst.exe
PID 1908 wrote to memory of 4476	1908	TeamViewer_Setup.exe	dllhоst.exe
PID 1908 wrote to memory of 4476	1908	TeamViewer_Setup.exe	dllhоst.exe
PID 4476 wrote to memory of 3600	4476	dllhоst.exe	reg.exe
PID 4476 wrote to memory of 3600	4476	dllhоst.exe	reg.exe
PID 4476 wrote to memory of 3600	4476	dllhоst.exe	reg.exe
PID 4476 wrote to memory of 1204	4476	dllhоst.exe	сsrss.exe
PID 4476 wrote to memory of 1204	4476	dllhоst.exe	сsrss.exe
PID 4476 wrote to memory of 1204	4476	dllhоst.exe	сsrss.exe

C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\dllhоst.exe
"C:\Windows\System32\dllhоst.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Windows\SysWOW64\dllhоst.exe /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:3600

C:\Windows\SysWOW64\сsrss.exe
"C:\Windows\SysWOW64\сsrss.exe"
3⤵
- Executes dropped EXE
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\dllhоst.exe
Filesize
130KB

MD5
2bdc96dbce5e135529f676c6b88764c7

SHA1
580f2ab7c6f326c623bbd7ae4868f42daa0571e4

SHA256
a0ad6a336ea6eb88b3ee5c053ad14c6407de5baa3220bc66059d093e0d9d9ceb

SHA512
5682b35829f564ee41f8474288fd55e892373686c17084b10ee739e2dd0fa4d63a147a795f7f27ae32da599686d9458091b8a716272d5ad8d7fbe56b7c0cb453

Download Submit
C:\Windows\SysWOW64\dllhоst.exe
Filesize
130KB

MD5
2bdc96dbce5e135529f676c6b88764c7

SHA1
580f2ab7c6f326c623bbd7ae4868f42daa0571e4

SHA256
a0ad6a336ea6eb88b3ee5c053ad14c6407de5baa3220bc66059d093e0d9d9ceb

SHA512
5682b35829f564ee41f8474288fd55e892373686c17084b10ee739e2dd0fa4d63a147a795f7f27ae32da599686d9458091b8a716272d5ad8d7fbe56b7c0cb453

Download Submit
C:\Windows\SysWOW64\dllhоst.exe
Filesize
130KB

MD5
2bdc96dbce5e135529f676c6b88764c7

SHA1
580f2ab7c6f326c623bbd7ae4868f42daa0571e4

SHA256
a0ad6a336ea6eb88b3ee5c053ad14c6407de5baa3220bc66059d093e0d9d9ceb

SHA512
5682b35829f564ee41f8474288fd55e892373686c17084b10ee739e2dd0fa4d63a147a795f7f27ae32da599686d9458091b8a716272d5ad8d7fbe56b7c0cb453

Download Submit
C:\Windows\SysWOW64\сsrss.exe
Filesize
115KB

MD5
baf28af74bec2fee218fc030c48ff403

SHA1
904379111848e20d2910e7122ea0713dc7dd76f4

SHA256
60ee28f72aad91470ce00cb75c029b0b2fbf440d734bdec00bd5bf8a6adfca5c

SHA512
6fcc43d6898a7e60a8c9ebdac31a4fc074ad0c20cbe4297b8d632ab653a01450a6b57cd43ae5126ff542517f1b6d43c56d62d23c863aa2e70650a9d265e6d081

Download Submit
C:\Windows\SysWOW64\сsrss.exe
Filesize
115KB

MD5
baf28af74bec2fee218fc030c48ff403

SHA1
904379111848e20d2910e7122ea0713dc7dd76f4

SHA256
60ee28f72aad91470ce00cb75c029b0b2fbf440d734bdec00bd5bf8a6adfca5c

SHA512
6fcc43d6898a7e60a8c9ebdac31a4fc074ad0c20cbe4297b8d632ab653a01450a6b57cd43ae5126ff542517f1b6d43c56d62d23c863aa2e70650a9d265e6d081

Download Submit
C:\Windows\SysWOW64\сsrss.exe
Filesize
115KB

MD5
baf28af74bec2fee218fc030c48ff403

SHA1
904379111848e20d2910e7122ea0713dc7dd76f4

SHA256
60ee28f72aad91470ce00cb75c029b0b2fbf440d734bdec00bd5bf8a6adfca5c

SHA512
6fcc43d6898a7e60a8c9ebdac31a4fc074ad0c20cbe4297b8d632ab653a01450a6b57cd43ae5126ff542517f1b6d43c56d62d23c863aa2e70650a9d265e6d081

Download Submit
memory/1204-173-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/1204-171-0x0000000009510000-0x0000000009576000-memory.dmp

Filesize
408KB

Download
memory/1204-169-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download
memory/1204-168-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/1204-167-0x00000000003A0000-0x00000000003C2000-memory.dmp

Filesize
136KB

Download
memory/1908-149-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/1908-133-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/1908-134-0x0000000000050000-0x0000000000082000-memory.dmp

Filesize
200KB

Download
memory/4476-153-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/4476-155-0x0000000004EB0000-0x0000000004F06000-memory.dmp

Filesize
344KB

Download
memory/4476-154-0x0000000004C50000-0x0000000004C5A000-memory.dmp

Filesize
40KB

Download
memory/4476-152-0x0000000004CC0000-0x0000000004D52000-memory.dmp

Filesize
584KB

Download
memory/4476-151-0x00000000051D0000-0x0000000005774000-memory.dmp

Filesize
5.6MB

Download
memory/4476-150-0x0000000004B80000-0x0000000004C1C000-memory.dmp

Filesize
624KB

Download
memory/4476-148-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/4476-170-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/4476-147-0x00000000002D0000-0x00000000002F8000-memory.dmp

Filesize
160KB

Download
memory/4476-172-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads