vanillarat | d548ea85db4681de9393a4bd8369283db49f9f0525356d15f8ca06259e4fa930

General

Target

Fortnite Checker.exe
Size

883KB
MD5

5ff30ec323f9e6ec632ea3b2180a1cbc
SHA1

aba95d8f4f7f634170cbad0461a3e6e0a4574059
SHA256

d548ea85db4681de9393a4bd8369283db49f9f0525356d15f8ca06259e4fa930
SHA512

e990b1de0d4f6c2f830bca0ddea747ab733289f8fc45f2da1b9e20128b9eabb51c8f2ed62ca0346bdbb20ca73b4ab871e2a0298e1f4df9d559d4bbee41cce66c
SSDEEP

12288:GToPWBv/cpGrU3ywFm/byWr+5q+LViWdEVr9WoMwtubIwyqd7zw:GTbBv5rU4/b9SDmVr98w009qdHw

Score

10^/10

vanillarat persistence rat

Malware Config

Signatures

VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
rat vanillarat

Vanilla Rat payload 2 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Fortnite.exe	vanillarat
behavioral1/memory/2292-46-0x0000000000C70000-0x0000000000C92000-memory.dmp	vanillarat

Executes dropped EXE 2 IoCs

Processes:

Fortnite.exeFortniteChecker.exe

pid process

2292 Fortnite.exe
2760 FortniteChecker.exe

pid	process
2292	Fortnite.exe
2760	FortniteChecker.exe

Loads dropped DLL 8 IoCs

Processes:

Fortnite Checker.exe

pid	process
1996	Fortnite Checker.exe
1996	Fortnite Checker.exe
1996	Fortnite Checker.exe
1996	Fortnite Checker.exe
1996	Fortnite Checker.exe
1996	Fortnite Checker.exe
1996	Fortnite Checker.exe
1996	Fortnite Checker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Fortnite.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fortnite = "C:\\Users\\Admin\\AppData\\Roaming\\Fortnite.exe"	Fortnite.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420409388"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000019ce00ca51cbc2cce5f48f02fb9c86b73da3cff13ac35abde42d23d842b4830c000000000e8000000002000020000000d45a82d74f2fca0050196ba491f691071b930e0c6f6a89b8251dfb6f625b36f4200000009b82b6f2e68fab01beff843cab018621e66a2f30f270b52a31a4ff5266a6277140000000045a471bec213aa7b7d10ad0338ea76c617c0d08eb0cff07ba1eb77e20441254acbd8a027eede8a4f56584a42f30f76ea67452b38b29c1a3cf8bd9001b74dd3f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206f4372dc98da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F540BB1-04CF-11EF-B944-E2C1BAF7F8C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007ee3b153d8761d06fe4b7a950778be7db3864f4146f8247c5d2e717fb88f92c1000000000e8000000002000020000000ab5e0564ae93b9d4b5f0b4b5b4cd444386c4fb3f7a56e282fa870979e2b10d0990000000c86ef326ca76edb6154a6d1affa40eedabbc7b536fcabc5f2872ef4198c4e87dbfcbde9ba4b8b85d0eca7bd6bb5af0c0c80b4607b4bf2bf2584f6dab1f96bb27780d1b269719b43ecf80c4720d5107b73fa9d418ac432d27450ad08f17ef091768b5c8cb274dd0e051853d6978890c6b14ce47b6ba7b7ada7bb0fb8b4809153fbdc7595f281ac759145578255e58c71a400000006b3994ac0946815e50a6642a16d3880be3cf7b0fa0ac4ba2fa05936b091730cc6fe484ff0fc9bbec813ea77916e121bac7c0e120110904824dcaa05979192cfc	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2668 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2668 iexplore.exe
2668 iexplore.exe
2516 IEXPLORE.EXE
2516 IEXPLORE.EXE
2516 IEXPLORE.EXE
2516 IEXPLORE.EXE

pid	process
2668	iexplore.exe

pid	process
2668	iexplore.exe
2668	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Fortnite Checker.exeFortniteChecker.exeiexplore.exe

description	pid	process	target process
PID 1996 wrote to memory of 2292	1996	Fortnite Checker.exe	Fortnite.exe
PID 1996 wrote to memory of 2292	1996	Fortnite Checker.exe	Fortnite.exe
PID 1996 wrote to memory of 2292	1996	Fortnite Checker.exe	Fortnite.exe
PID 1996 wrote to memory of 2292	1996	Fortnite Checker.exe	Fortnite.exe
PID 1996 wrote to memory of 2760	1996	Fortnite Checker.exe	FortniteChecker.exe
PID 1996 wrote to memory of 2760	1996	Fortnite Checker.exe	FortniteChecker.exe
PID 1996 wrote to memory of 2760	1996	Fortnite Checker.exe	FortniteChecker.exe
PID 1996 wrote to memory of 2760	1996	Fortnite Checker.exe	FortniteChecker.exe
PID 2760 wrote to memory of 2668	2760	FortniteChecker.exe	iexplore.exe
PID 2760 wrote to memory of 2668	2760	FortniteChecker.exe	iexplore.exe
PID 2760 wrote to memory of 2668	2760	FortniteChecker.exe	iexplore.exe
PID 2760 wrote to memory of 2668	2760	FortniteChecker.exe	iexplore.exe
PID 2668 wrote to memory of 2516	2668	iexplore.exe	IEXPLORE.EXE
PID 2668 wrote to memory of 2516	2668	iexplore.exe	IEXPLORE.EXE
PID 2668 wrote to memory of 2516	2668	iexplore.exe	IEXPLORE.EXE
PID 2668 wrote to memory of 2516	2668	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\Fortnite Checker.exe
"C:\Users\Admin\AppData\Local\Temp\Fortnite Checker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Roaming\Fortnite.exe
"C:\Users\Admin\AppData\Roaming\Fortnite.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2292

C:\Users\Admin\AppData\Roaming\FortniteChecker.exe
"C:\Users\Admin\AppData\Roaming\FortniteChecker.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=FortniteChecker.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2516

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Fortnite.exe
Filesize
114KB

MD5
4bd20275a3148a44bf040367a43f6fe2

SHA1
4faa5b6fca5f3b31b00995b4372f635b1ed3a019

SHA256
98efc33ad38ab3a913716402cb445a25e5e578bdd379494c0188b30028430336

SHA512
ba5477c92038704feea1988228b25c82107f1803a3a331ba4337ae48dcdd019b6fc9f3e7fc14ace08b6637ce85ae4ad029a6d1d60ee4daac6a82c0cc1466bc66

Download Submit
C:\Users\Admin\AppData\Roaming\FortniteChecker.exe.config
Filesize
184B

MD5
13ff21470b63470978e08e4933eb8e56

SHA1
3fa7077272c55e85141236d90d302975e3d14b2e

SHA256
16286566d54d81c3721f7ecf7f426d965de364e9be2f9e628d7363b684b6fe6a

SHA512
56d0e52874744df091ba8421eeda9c37854ece32a826bd251f74b88b6334df69736b8cd97104e6e7b2279ef01d2144fee100392744cc1afb7025ebbad5c307a8

Download Submit
\Users\Admin\AppData\Roaming\FortniteChecker.exe
Filesize
83KB

MD5
f5d8bedb9dcc17a0a356f2f3f621971e

SHA1
76ed7763602cc198be87b3eb51949f54ae9c0f9b

SHA256
355ae598c711cf98fb78b485fe2bf351233e81d5b98ffd3c81b20470182e6ebe

SHA512
ee5c55a562259481199def67fba592bfa1b524fc4eaa5c9b558f6fbb9609542b0f1a915768f79662a6b7fd2f8127c013aa2fb08a249f5bba89aafad03c9e99eb

Download Submit
memory/2292-46-0x0000000000C70000-0x0000000000C92000-memory.dmp

Filesize
136KB

Download
memory/2292-47-0x0000000073D60000-0x000000007444E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-48-0x0000000073D60000-0x000000007444E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads