vanillarat | 606c98c07040d9eda305b09b8e8e0be81617bd663b3e83f1d9293109833a1fc5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 02:40

Target

54ee0eee469f716331e3f7192356644d.exe
Size

114KB
MD5

54ee0eee469f716331e3f7192356644d
SHA1

a320a90a9ec98a4e956b6fe711e8660081a3f45a
SHA256

606c98c07040d9eda305b09b8e8e0be81617bd663b3e83f1d9293109833a1fc5
SHA512

b65131d16e7268f73c81b17112184b189d59e7be42d590b60047b4692a2c6f072a3473190a970200d18d185c497e689406ced351ce7d5fdfc709073a4afe8505
SSDEEP

3072:MgZApdYrD28fbJB2yLtyTIbjjxK3QdjrxivW+DXnH4vymbG1w:M/pe1J0IbXtrxivW+D34vc

Score

10^/10

vanillarat rat

VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
rat vanillarat

Vanilla Rat payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2760-1-0x0000000000690000-0x00000000006B2000-memory.dmp	vanillarat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

75 0.tcp.ngrok.io
112 0.tcp.ngrok.io
115 0.tcp.ngrok.io
12 0.tcp.ngrok.io
33 0.tcp.ngrok.io

C:\Users\Admin\AppData\Local\Temp\54ee0eee469f716331e3f7192356644d.exe
"C:\Users\Admin\AppData\Local\Temp\54ee0eee469f716331e3f7192356644d.exe"
1⤵
PID:2760

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

memory/2760-0-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

Filesize
4KB

Download
memory/2760-1-0x0000000000690000-0x00000000006B2000-memory.dmp

Filesize
136KB

Download
memory/2760-2-0x00000000055C0000-0x0000000005B64000-memory.dmp

Filesize
5.6MB

Download
memory/2760-3-0x0000000004F60000-0x0000000004FF2000-memory.dmp

Filesize
584KB

Download
memory/2760-4-0x0000000005130000-0x000000000513A000-memory.dmp

Filesize
40KB

Download
memory/2760-5-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download
memory/2760-6-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

Filesize
4KB

Download
memory/2760-7-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download