vanillarat | f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3

General

Target

f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe
Size

262KB
MD5

bbcc8d6a95a55db7ca0d7c13c4001cc1
SHA1

b78619aa278f8b509bcae75743bf57a178d954f5
SHA256

f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3
SHA512

f1848a40e65cc321ce0bac526a81afde701816d82bad5299bb866a3915b5b77b0bb69863a8efbb3ec9eff8574bc33fa4de0e797cffc9f24720e15b43d29084a3
SSDEEP

3072:/M34HhBc6OoSt96DWV2Uy+fmT/xzgA8MOoovdXXRRv2psoXWb9ZDGL4lXslzlq:/04HhBc6OXt96DWVvyjTFNwxXcUo

Score

10^/10

vanillarat discovery rat

Malware Config

Signatures

VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
rat vanillarat

Vanilla Rat payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2020-8-0x0000000000400000-0x0000000000422000-memory.dmp	vanillarat
behavioral1/memory/2020-12-0x0000000000400000-0x0000000000422000-memory.dmp	vanillarat
behavioral1/memory/2020-10-0x0000000000400000-0x0000000000422000-memory.dmp	vanillarat
behavioral1/memory/2020-6-0x0000000000400000-0x0000000000422000-memory.dmp	vanillarat
behavioral1/memory/2020-5-0x0000000000400000-0x0000000000422000-memory.dmp	vanillarat

Executes dropped EXE 1 IoCs

Processes:

MSBuild.exe

pid process

2660 MSBuild.exe
Loads dropped DLL 1 IoCs

Processes:

MSBuild.exe

pid process

2020 MSBuild.exe

pid	process
2660	MSBuild.exe

pid	process
2020	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe

description	pid	process	target process
PID 1904 set thread context of 2020	1904	f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe	MSBuild.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exeMSBuild.exeMSBuild.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 2020 MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	2020	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exeMSBuild.exe

description	pid	process	target process
PID 1904 wrote to memory of 2020	1904	f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe	MSBuild.exe
PID 1904 wrote to memory of 2020	1904	f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe	MSBuild.exe
PID 1904 wrote to memory of 2020	1904	f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe	MSBuild.exe
PID 1904 wrote to memory of 2020	1904	f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe	MSBuild.exe
PID 1904 wrote to memory of 2020	1904	f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe	MSBuild.exe
PID 1904 wrote to memory of 2020	1904	f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe	MSBuild.exe
PID 1904 wrote to memory of 2020	1904	f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe	MSBuild.exe
PID 1904 wrote to memory of 2020	1904	f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe	MSBuild.exe
PID 1904 wrote to memory of 2020	1904	f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe	MSBuild.exe
PID 2020 wrote to memory of 2660	2020	MSBuild.exe	MSBuild.exe
PID 2020 wrote to memory of 2660	2020	MSBuild.exe	MSBuild.exe
PID 2020 wrote to memory of 2660	2020	MSBuild.exe	MSBuild.exe
PID 2020 wrote to memory of 2660	2020	MSBuild.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe
"C:\Users\Admin\AppData\Local\Temp\f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #by-unknown
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\AppData\Roaming\MSBuild.exe
    "C:\Users\Admin\AppData\Roaming\MSBuild.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\MSBuild.exe

Filesize
255KB

MD5
9af17c8393f0970ee5136bd3ffa27001

SHA1
4b285b72c1a11285a25f31f2597e090da6bbc049

SHA256
71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

SHA512
b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

Download Submit
memory/1904-13-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download
memory/1904-1-0x0000000000040000-0x0000000000088000-memory.dmp

Filesize
288KB

Download
memory/1904-2-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download
memory/1904-0-0x0000000074CEE000-0x0000000074CEF000-memory.dmp

Filesize
4KB

Download
memory/2020-6-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2020-10-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2020-7-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2020-12-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2020-5-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2020-4-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2020-3-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2020-14-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download
memory/2020-15-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download
memory/2020-8-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2020-24-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download
memory/2660-23-0x0000000000EF0000-0x0000000000F30000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads