Analysis
-
max time kernel
9s -
max time network
13s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
19-07-2023 16:25
Behavioral task
behavioral1
Sample
TeamViewer_Setup.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
TeamViewer_Setup.exe
Resource
win10-20230703-en
Behavioral task
behavioral3
Sample
TeamViewer_Setup.exe
Resource
win10v2004-20230703-en
Errors
General
-
Target
TeamViewer_Setup.exe
-
Size
470KB
-
MD5
b3c7ffb0c5ba452d0c68da59f90b39af
-
SHA1
ee538ad689a49911cc4befae22269b8c3a261caa
-
SHA256
7411a95cf987a085c9bb3990cab95b8479e752b1c4370c9c256c07dd64f6b7b9
-
SHA512
d0a89e233aa03983f5b8d7067a923469b48eaac6d24f2a73ce22afdeefa2eb1c2976a69b511c25ff2845b49f43dfd2e68d7083506a162bb3b6669c5ee644b36e
-
SSDEEP
6144:eqly+sJZKBI09yYeY4eoiJ+sCFv1peInLz+:RRyYrZos+xFvHL6
Malware Config
Signatures
-
Processes:
reg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2236-54-0x0000000000C80000-0x0000000000CFE000-memory.dmp vanillarat -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EsetNOD32 = "C:\\Windows\\System32\\dllhоst.exe" reg.exe -
Drops file in System32 directory 2 IoCs
Processes:
TeamViewer_Setup.exedescription ioc process File created C:\Windows\SysWOW64\dllhоst.exe TeamViewer_Setup.exe File created C:\Windows\SysWOW64\install.cmd TeamViewer_Setup.exe -
Modifies registry key 1 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
TeamViewer_Setup.exeshutdown.exedescription pid process Token: SeDebugPrivilege 2236 TeamViewer_Setup.exe Token: SeShutdownPrivilege 2224 shutdown.exe Token: SeRemoteShutdownPrivilege 2224 shutdown.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
TeamViewer_Setup.execmd.execmd.exedescription pid process target process PID 2236 wrote to memory of 1636 2236 TeamViewer_Setup.exe cmd.exe PID 2236 wrote to memory of 1636 2236 TeamViewer_Setup.exe cmd.exe PID 2236 wrote to memory of 1636 2236 TeamViewer_Setup.exe cmd.exe PID 2236 wrote to memory of 1636 2236 TeamViewer_Setup.exe cmd.exe PID 1636 wrote to memory of 2200 1636 cmd.exe reg.exe PID 1636 wrote to memory of 2200 1636 cmd.exe reg.exe PID 1636 wrote to memory of 2200 1636 cmd.exe reg.exe PID 1636 wrote to memory of 2200 1636 cmd.exe reg.exe PID 2236 wrote to memory of 1480 2236 TeamViewer_Setup.exe cmd.exe PID 2236 wrote to memory of 1480 2236 TeamViewer_Setup.exe cmd.exe PID 2236 wrote to memory of 1480 2236 TeamViewer_Setup.exe cmd.exe PID 2236 wrote to memory of 1480 2236 TeamViewer_Setup.exe cmd.exe PID 2236 wrote to memory of 1480 2236 TeamViewer_Setup.exe cmd.exe PID 2236 wrote to memory of 1480 2236 TeamViewer_Setup.exe cmd.exe PID 2236 wrote to memory of 1480 2236 TeamViewer_Setup.exe cmd.exe PID 1480 wrote to memory of 1172 1480 cmd.exe reg.exe PID 1480 wrote to memory of 1172 1480 cmd.exe reg.exe PID 1480 wrote to memory of 1172 1480 cmd.exe reg.exe PID 1480 wrote to memory of 1172 1480 cmd.exe reg.exe PID 1480 wrote to memory of 2224 1480 cmd.exe shutdown.exe PID 1480 wrote to memory of 2224 1480 cmd.exe shutdown.exe PID 1480 wrote to memory of 2224 1480 cmd.exe shutdown.exe PID 1480 wrote to memory of 2224 1480 cmd.exe shutdown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v EsetNOD32 /t REG_SZ /d C:\Windows\System32\dllhоst.exe /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v EsetNOD32 /t REG_SZ /d C:\Windows\System32\dllhоst.exe /f3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\System32\install.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\shutdown.exeshutdown -r -t 13⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\install.cmdFilesize
139B
MD56bb1de604664795e452c73659ff8ced7
SHA193587cb366f8f46ad592f4eb9850837e1cafef73
SHA25669e87d18a60bc161d236af5471c6598b6897e297d2b26f0b3e9a63bd4475501f
SHA512e71dda2217b6bf338e8ade43249d7a726ee93d504760c11694232b1d4b15d41557d8f61f451f6c8b67f86b9acc16e214d2dc479fed24c4e67bd1169dff553bcd
-
C:\Windows\SysWOW64\install.cmdFilesize
139B
MD56bb1de604664795e452c73659ff8ced7
SHA193587cb366f8f46ad592f4eb9850837e1cafef73
SHA25669e87d18a60bc161d236af5471c6598b6897e297d2b26f0b3e9a63bd4475501f
SHA512e71dda2217b6bf338e8ade43249d7a726ee93d504760c11694232b1d4b15d41557d8f61f451f6c8b67f86b9acc16e214d2dc479fed24c4e67bd1169dff553bcd
-
memory/552-66-0x00000000029C0000-0x00000000029C1000-memory.dmpFilesize
4KB
-
memory/2236-54-0x0000000000C80000-0x0000000000CFE000-memory.dmpFilesize
504KB
-
memory/2236-55-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/2236-65-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/3056-67-0x0000000002760000-0x0000000002761000-memory.dmpFilesize
4KB