Analysis
-
max time kernel
144s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10-08-2024 13:46
Static task
static1
Behavioral task
behavioral1
Sample
f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe
Resource
win10v2004-20240802-en
General
-
Target
f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe
-
Size
262KB
-
MD5
bbcc8d6a95a55db7ca0d7c13c4001cc1
-
SHA1
b78619aa278f8b509bcae75743bf57a178d954f5
-
SHA256
f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3
-
SHA512
f1848a40e65cc321ce0bac526a81afde701816d82bad5299bb866a3915b5b77b0bb69863a8efbb3ec9eff8574bc33fa4de0e797cffc9f24720e15b43d29084a3
-
SSDEEP
3072:/M34HhBc6OoSt96DWV2Uy+fmT/xzgA8MOoovdXXRRv2psoXWb9ZDGL4lXslzlq:/04HhBc6OXt96DWVvyjTFNwxXcUo
Malware Config
Signatures
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2492-2-0x0000000000400000-0x0000000000422000-memory.dmp vanillarat -
Executes dropped EXE 1 IoCs
Processes:
MSBuild.exepid process 4988 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exedescription pid process target process PID 4444 set thread context of 2492 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe MSBuild.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exeMSBuild.exeMSBuild.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exepid process 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe Token: SeDebugPrivilege 2492 MSBuild.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exeMSBuild.exedescription pid process target process PID 4444 wrote to memory of 732 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe MSBuild.exe PID 4444 wrote to memory of 732 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe MSBuild.exe PID 4444 wrote to memory of 732 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe MSBuild.exe PID 4444 wrote to memory of 2492 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe MSBuild.exe PID 4444 wrote to memory of 2492 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe MSBuild.exe PID 4444 wrote to memory of 2492 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe MSBuild.exe PID 4444 wrote to memory of 2492 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe MSBuild.exe PID 4444 wrote to memory of 2492 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe MSBuild.exe PID 4444 wrote to memory of 2492 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe MSBuild.exe PID 4444 wrote to memory of 2492 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe MSBuild.exe PID 4444 wrote to memory of 2492 4444 f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe MSBuild.exe PID 2492 wrote to memory of 4988 2492 MSBuild.exe MSBuild.exe PID 2492 wrote to memory of 4988 2492 MSBuild.exe MSBuild.exe PID 2492 wrote to memory of 4988 2492 MSBuild.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe"C:\Users\Admin\AppData\Local\Temp\f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe#by-unknown2⤵PID:732
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe#by-unknown2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Roaming\MSBuild.exe"C:\Users\Admin\AppData\Roaming\MSBuild.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4988
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be