Analysis
-
max time kernel
135s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
09-07-2024 14:31
General
-
Target
x64DBG.exe
-
Size
114KB
-
MD5
3789a9c16a98cf9de876ee9d7a2e20e8
-
SHA1
d1d1e11b7e39efb6caf25a4f5ec74e5943909efd
-
SHA256
ab331be0645a04eb3f3483bf11ea2b57208779101e9f77e3537970fb62ca7491
-
SHA512
1ba601a52ed1f50558691592dd3c09cb52f9664f9e8add3b5665f42bcb63e14a5b89979888e2d94abf783677d6e88066bb91cea39cce970edc22a943276a6c65
-
SSDEEP
3072:fgZApdYrD28fbJB2yLtyTEbjjxK3QdjrxivW+DXnH4vymbv1k:f/pe1J0EbXtrxivW+D34vb
Score
10/10
Malware Config
Signatures
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\x64DBG.exe"C:\Users\Admin\AppData\Local\Temp\x64DBG.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\-wnzh9.exe"C:\Windows\System32\-wnzh9.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
40KB