vanillarat | 92d129825bda8b18723026a90fcc19bed5614c7ba17b1a50e1ed91518fc93752

Analysis

max time kernel
150s
max time network
169s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-01-2024 16:54

Target

3e82d4b205d458e65db00eb0f4231546.exe
Size

114KB
MD5

3e82d4b205d458e65db00eb0f4231546
SHA1

6047758f81a94f3738f0901f9d04cb4e25abbe34
SHA256

92d129825bda8b18723026a90fcc19bed5614c7ba17b1a50e1ed91518fc93752
SHA512

99804e70e2901414db122096f6ef72c5cc652fefbfe129d2b5e91dd11e33b94e878d090971f890e2b335200823f441464263f959e7574a47a9afcbda3a2102bf
SSDEEP

3072:tgZApdYrD28fbJB2yLtyT4bjjxK3QdjrxivW+DXnH4vymbc1g:t/pe1J04bXtrxivW+D34vC

Score

10^/10

vanillarat rat

VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
rat vanillarat

Vanilla Rat payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1704-0-0x0000000000B30000-0x0000000000B52000-memory.dmp	vanillarat

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

C:\Users\Admin\AppData\Local\Temp\3e82d4b205d458e65db00eb0f4231546.exe
"C:\Users\Admin\AppData\Local\Temp\3e82d4b205d458e65db00eb0f4231546.exe"
1⤵
PID:1704

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

memory/1704-0-0x0000000000B30000-0x0000000000B52000-memory.dmp

Filesize
136KB

Download
memory/1704-1-0x0000000074C50000-0x000000007533E000-memory.dmp

Filesize
6.9MB

Download
memory/1704-2-0x00000000042E0000-0x0000000004320000-memory.dmp

Filesize
256KB

Download
memory/1704-3-0x0000000074C50000-0x000000007533E000-memory.dmp

Filesize
6.9MB

Download
memory/1704-4-0x00000000042E0000-0x0000000004320000-memory.dmp

Filesize
256KB

Download