Analysis
-
max time kernel
135s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
09-07-2024 14:31
General
-
Target
x64DBG.exe
-
Size
114KB
-
MD5
3789a9c16a98cf9de876ee9d7a2e20e8
-
SHA1
d1d1e11b7e39efb6caf25a4f5ec74e5943909efd
-
SHA256
ab331be0645a04eb3f3483bf11ea2b57208779101e9f77e3537970fb62ca7491
-
SHA512
1ba601a52ed1f50558691592dd3c09cb52f9664f9e8add3b5665f42bcb63e14a5b89979888e2d94abf783677d6e88066bb91cea39cce970edc22a943276a6c65
-
SSDEEP
3072:fgZApdYrD28fbJB2yLtyTEbjjxK3QdjrxivW+DXnH4vymbv1k:f/pe1J0EbXtrxivW+D34vb
Score
10/10
Malware Config
Signatures
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\x64DBG.exe"C:\Users\Admin\AppData\Local\Temp\x64DBG.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\-wnzh9.exe"C:\Windows\System32\-wnzh9.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1608-15-0x000002B9E2BE0000-0x000002B9E2BE1000-memory.dmpFilesize
4KB
-
memory/1608-16-0x000002B9E2BE0000-0x000002B9E2BE1000-memory.dmpFilesize
4KB
-
memory/1608-10-0x000002B9E2BE0000-0x000002B9E2BE1000-memory.dmpFilesize
4KB
-
memory/1608-9-0x000002B9E2BE0000-0x000002B9E2BE1000-memory.dmpFilesize
4KB
-
memory/1608-8-0x000002B9E2BE0000-0x000002B9E2BE1000-memory.dmpFilesize
4KB
-
memory/1608-18-0x000002B9E2BE0000-0x000002B9E2BE1000-memory.dmpFilesize
4KB
-
memory/1608-19-0x000002B9E2BE0000-0x000002B9E2BE1000-memory.dmpFilesize
4KB
-
memory/1608-20-0x000002B9E2BE0000-0x000002B9E2BE1000-memory.dmpFilesize
4KB
-
memory/1608-17-0x000002B9E2BE0000-0x000002B9E2BE1000-memory.dmpFilesize
4KB
-
memory/1608-14-0x000002B9E2BE0000-0x000002B9E2BE1000-memory.dmpFilesize
4KB
-
memory/4968-5-0x0000000074C00000-0x00000000753B0000-memory.dmpFilesize
7.7MB
-
memory/4968-3-0x0000000005780000-0x0000000005812000-memory.dmpFilesize
584KB
-
memory/4968-0-0x0000000074C0E000-0x0000000074C0F000-memory.dmpFilesize
4KB
-
memory/4968-2-0x0000000005D30000-0x00000000062D4000-memory.dmpFilesize
5.6MB
-
memory/4968-7-0x0000000074C00000-0x00000000753B0000-memory.dmpFilesize
7.7MB
-
memory/4968-6-0x0000000074C0E000-0x0000000074C0F000-memory.dmpFilesize
4KB
-
memory/4968-1-0x0000000000D60000-0x0000000000D82000-memory.dmpFilesize
136KB
-
memory/4968-4-0x0000000005840000-0x000000000584A000-memory.dmpFilesize
40KB