vanillarat | ab331be0645a04eb3f3483bf11ea2b57208779101e9f77e3537970fb62ca7491 | Triage

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 14:35

Sharing

Report Analysis Logs

General

Target

x64DBG.exe
Size

114KB
MD5

3789a9c16a98cf9de876ee9d7a2e20e8
SHA1

d1d1e11b7e39efb6caf25a4f5ec74e5943909efd
SHA256

ab331be0645a04eb3f3483bf11ea2b57208779101e9f77e3537970fb62ca7491
SHA512

1ba601a52ed1f50558691592dd3c09cb52f9664f9e8add3b5665f42bcb63e14a5b89979888e2d94abf783677d6e88066bb91cea39cce970edc22a943276a6c65
SSDEEP

3072:fgZApdYrD28fbJB2yLtyTEbjjxK3QdjrxivW+DXnH4vymbv1k:f/pe1J0EbXtrxivW+D34vb

Score

10^/10

vanillarat rat

Malware Config

Signatures

VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
rat vanillarat

Vanilla Rat payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2552-1-0x0000000000BA0000-0x0000000000BC2000-memory.dmp	vanillarat

C:\Users\Admin\AppData\Local\Temp\x64DBG.exe
"C:\Users\Admin\AppData\Local\Temp\x64DBG.exe"
1⤵
PID:2552

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2280

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" SYSTEM
1⤵
PID:2684

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-0-0x00000000746FE000-0x00000000746FF000-memory.dmp

Filesize
4KB

Download
memory/2552-1-0x0000000000BA0000-0x0000000000BC2000-memory.dmp

Filesize
136KB

Download
memory/2552-2-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download
memory/2552-3-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download