vanillarat | 606c98c07040d9eda305b09b8e8e0be81617bd663b3e83f1d9293109833a1fc5

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-07-2024 21:49

Target

54ee0eee469f716331e3f7192356644d_JaffaCakes118.exe
Size

114KB
MD5

54ee0eee469f716331e3f7192356644d
SHA1

a320a90a9ec98a4e956b6fe711e8660081a3f45a
SHA256

606c98c07040d9eda305b09b8e8e0be81617bd663b3e83f1d9293109833a1fc5
SHA512

b65131d16e7268f73c81b17112184b189d59e7be42d590b60047b4692a2c6f072a3473190a970200d18d185c497e689406ced351ce7d5fdfc709073a4afe8505
SSDEEP

3072:MgZApdYrD28fbJB2yLtyTIbjjxK3QdjrxivW+DXnH4vymbG1w:M/pe1J0IbXtrxivW+D34vc

Score

10^/10

vanillarat rat

VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
rat vanillarat

Vanilla Rat payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2092-1-0x0000000000D20000-0x0000000000D42000-memory.dmp	vanillarat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

13 0.tcp.ngrok.io
17 0.tcp.ngrok.io
2 0.tcp.ngrok.io
7 0.tcp.ngrok.io

C:\Users\Admin\AppData\Local\Temp\54ee0eee469f716331e3f7192356644d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\54ee0eee469f716331e3f7192356644d_JaffaCakes118.exe"
1⤵
PID:2092

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

memory/2092-0-0x0000000073F9E000-0x0000000073F9F000-memory.dmp

Filesize
4KB

Download
memory/2092-1-0x0000000000D20000-0x0000000000D42000-memory.dmp

Filesize
136KB

Download
memory/2092-2-0x0000000073F90000-0x000000007467E000-memory.dmp

Filesize
6.9MB

Download
memory/2092-3-0x0000000073F90000-0x000000007467E000-memory.dmp

Filesize
6.9MB

Download