Analysis

  • max time kernel
    95s
  • max time network
    100s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22-07-2023 10:12

General

  • Target

    basic.exe

  • Size

    115KB

  • MD5

    40a686daef5032b86eadeb9e017e01c4

  • SHA1

    3a91374cab9977190baa9b94ea4d433f47257ba4

  • SHA256

    af257f0e835be7e2d87d1e58a8f4ee22abad6684dbac081795f57276712696f3

  • SHA512

    12b12c85fbee63bcc3c65bc11d5e7949eb12c0060f7b1545a2fe6b130471a9adf355d043de81ccd80c6039e2e0341895a3037171c6f3633376f789fbbb6718d6

  • SSDEEP

    3072:SJZKnPE2YyJzELtyTFyYeY8lNgoiJ+sX8HFvytboN:SJZKBI0FyYeY4eoiJ+sCFvP

Score
10/10

Malware Config

Signatures

  • VanillaRat

    VanillaRat is an advanced remote administration tool coded in C#.

  • Vanilla Rat payload 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\basic.exe
    "C:\Users\Admin\AppData\Local\Temp\basic.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:792

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/792-120-0x0000000000EB0000-0x0000000000ED2000-memory.dmp
    Filesize

    136KB

  • memory/792-121-0x00000000731C0000-0x00000000738AE000-memory.dmp
    Filesize

    6.9MB

  • memory/792-122-0x0000000005CA0000-0x000000000619E000-memory.dmp
    Filesize

    5.0MB

  • memory/792-123-0x00000000057A0000-0x0000000005832000-memory.dmp
    Filesize

    584KB

  • memory/792-124-0x0000000005720000-0x0000000005730000-memory.dmp
    Filesize

    64KB

  • memory/792-125-0x0000000005750000-0x000000000575A000-memory.dmp
    Filesize

    40KB

  • memory/792-126-0x0000000009D30000-0x0000000009D96000-memory.dmp
    Filesize

    408KB

  • memory/792-127-0x00000000731C0000-0x00000000738AE000-memory.dmp
    Filesize

    6.9MB

  • memory/792-128-0x0000000005720000-0x0000000005730000-memory.dmp
    Filesize

    64KB

  • memory/792-129-0x00000000731C0000-0x00000000738AE000-memory.dmp
    Filesize

    6.9MB