Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    18-07-2023 02:03

General

  • Target

    b4d092bdd58610ec77ef6713fe7559c39a52f77d37f8a3c5044e1b95e98f969e.exe

  • Size

    267KB

  • MD5

    8c9c29e59baf663d0b071b9efdec3bea

  • SHA1

    dbb8afc9bab40bf175322840b01d474303c38daf

  • SHA256

    b4d092bdd58610ec77ef6713fe7559c39a52f77d37f8a3c5044e1b95e98f969e

  • SHA512

    5dcdb29f21c758af40c65b96e2ae2bfa3a24388fb1c924118e258b90af2ed59b676122229de424c2c26f5050e643e4a8b3add3eaa5df6c4ba361b115cecbefd3

  • SSDEEP

    6144:EJZKBI0RyYeY4eoiJ+sCFvTK2/LZZ3Ru79kkkkkkkkkkkkkkkkskkkkkkkkkkkkq:1yYrZos+xFv5RupkkkkkkkkkkkkkkkkZ

Malware Config

Signatures

  • VanillaRat

    VanillaRat is an advanced remote administration tool coded in C#.

  • Vanilla Rat payload 10 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4d092bdd58610ec77ef6713fe7559c39a52f77d37f8a3c5044e1b95e98f969e.exe
    "C:\Users\Admin\AppData\Local\Temp\b4d092bdd58610ec77ef6713fe7559c39a52f77d37f8a3c5044e1b95e98f969e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\svchost.exe
      "C:\Users\Admin\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2960
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:2944

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Command and Control

Web Service

1
T1102

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\svchost.exe
    Filesize

    115KB

    MD5

    2e5422412d23d9f1c1dff78719447728

    SHA1

    00440171a8963d4454aa8e63fb3a25fd85585091

    SHA256

    3f0ce66700b7011c8fa2e8a1709c43fb79882721afa0f5e1bbeb8a5c29d81d03

    SHA512

    77b31e4a05b73495b4ca8698b046bef8cdec82845d316b304679b2521529be38d1dd0cd4e471cf04097ce734f588312214687ec0c8582a5ff5676b68b4e61521

  • C:\Users\Admin\AppData\Roaming\svchost.exe
    Filesize

    115KB

    MD5

    2e5422412d23d9f1c1dff78719447728

    SHA1

    00440171a8963d4454aa8e63fb3a25fd85585091

    SHA256

    3f0ce66700b7011c8fa2e8a1709c43fb79882721afa0f5e1bbeb8a5c29d81d03

    SHA512

    77b31e4a05b73495b4ca8698b046bef8cdec82845d316b304679b2521529be38d1dd0cd4e471cf04097ce734f588312214687ec0c8582a5ff5676b68b4e61521

  • C:\Users\Admin\svchost.exe
    Filesize

    115KB

    MD5

    2e5422412d23d9f1c1dff78719447728

    SHA1

    00440171a8963d4454aa8e63fb3a25fd85585091

    SHA256

    3f0ce66700b7011c8fa2e8a1709c43fb79882721afa0f5e1bbeb8a5c29d81d03

    SHA512

    77b31e4a05b73495b4ca8698b046bef8cdec82845d316b304679b2521529be38d1dd0cd4e471cf04097ce734f588312214687ec0c8582a5ff5676b68b4e61521

  • C:\Users\Admin\svchost.exe
    Filesize

    115KB

    MD5

    2e5422412d23d9f1c1dff78719447728

    SHA1

    00440171a8963d4454aa8e63fb3a25fd85585091

    SHA256

    3f0ce66700b7011c8fa2e8a1709c43fb79882721afa0f5e1bbeb8a5c29d81d03

    SHA512

    77b31e4a05b73495b4ca8698b046bef8cdec82845d316b304679b2521529be38d1dd0cd4e471cf04097ce734f588312214687ec0c8582a5ff5676b68b4e61521

  • C:\Users\Admin\svchost.exe
    Filesize

    115KB

    MD5

    2e5422412d23d9f1c1dff78719447728

    SHA1

    00440171a8963d4454aa8e63fb3a25fd85585091

    SHA256

    3f0ce66700b7011c8fa2e8a1709c43fb79882721afa0f5e1bbeb8a5c29d81d03

    SHA512

    77b31e4a05b73495b4ca8698b046bef8cdec82845d316b304679b2521529be38d1dd0cd4e471cf04097ce734f588312214687ec0c8582a5ff5676b68b4e61521

  • \Users\Admin\AppData\Roaming\svchost.exe
    Filesize

    115KB

    MD5

    2e5422412d23d9f1c1dff78719447728

    SHA1

    00440171a8963d4454aa8e63fb3a25fd85585091

    SHA256

    3f0ce66700b7011c8fa2e8a1709c43fb79882721afa0f5e1bbeb8a5c29d81d03

    SHA512

    77b31e4a05b73495b4ca8698b046bef8cdec82845d316b304679b2521529be38d1dd0cd4e471cf04097ce734f588312214687ec0c8582a5ff5676b68b4e61521

  • \Users\Admin\svchost.exe
    Filesize

    115KB

    MD5

    2e5422412d23d9f1c1dff78719447728

    SHA1

    00440171a8963d4454aa8e63fb3a25fd85585091

    SHA256

    3f0ce66700b7011c8fa2e8a1709c43fb79882721afa0f5e1bbeb8a5c29d81d03

    SHA512

    77b31e4a05b73495b4ca8698b046bef8cdec82845d316b304679b2521529be38d1dd0cd4e471cf04097ce734f588312214687ec0c8582a5ff5676b68b4e61521

  • memory/2236-54-0x0000000000DE0000-0x0000000000E2A000-memory.dmp
    Filesize

    296KB

  • memory/2236-55-0x0000000073CE0000-0x00000000743CE000-memory.dmp
    Filesize

    6.9MB

  • memory/2236-66-0x0000000073CE0000-0x00000000743CE000-memory.dmp
    Filesize

    6.9MB

  • memory/2944-75-0x00000000001C0000-0x00000000001E2000-memory.dmp
    Filesize

    136KB

  • memory/2944-77-0x0000000073CE0000-0x00000000743CE000-memory.dmp
    Filesize

    6.9MB

  • memory/2944-78-0x0000000004D20000-0x0000000004D60000-memory.dmp
    Filesize

    256KB

  • memory/2944-79-0x0000000073CE0000-0x00000000743CE000-memory.dmp
    Filesize

    6.9MB

  • memory/2944-80-0x0000000004D20000-0x0000000004D60000-memory.dmp
    Filesize

    256KB

  • memory/2960-67-0x0000000004E20000-0x0000000004E60000-memory.dmp
    Filesize

    256KB

  • memory/2960-65-0x0000000073CE0000-0x00000000743CE000-memory.dmp
    Filesize

    6.9MB

  • memory/2960-76-0x0000000073CE0000-0x00000000743CE000-memory.dmp
    Filesize

    6.9MB

  • memory/2960-64-0x00000000010B0000-0x00000000010D2000-memory.dmp
    Filesize

    136KB