Analysis

  • max time kernel
    144s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-08-2024 13:46

General

  • Target

    f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe

  • Size

    262KB

  • MD5

    bbcc8d6a95a55db7ca0d7c13c4001cc1

  • SHA1

    b78619aa278f8b509bcae75743bf57a178d954f5

  • SHA256

    f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3

  • SHA512

    f1848a40e65cc321ce0bac526a81afde701816d82bad5299bb866a3915b5b77b0bb69863a8efbb3ec9eff8574bc33fa4de0e797cffc9f24720e15b43d29084a3

  • SSDEEP

    3072:/M34HhBc6OoSt96DWV2Uy+fmT/xzgA8MOoovdXXRRv2psoXWb9ZDGL4lXslzlq:/04HhBc6OXt96DWVvyjTFNwxXcUo

Malware Config

Signatures

  • VanillaRat

    VanillaRat is an advanced remote administration tool coded in C#.

  • Vanilla Rat payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe
    "C:\Users\Admin\AppData\Local\Temp\f05a9ea1aa0a3f710c58366adf8c58ee9525537cbf2f621f753bd4a1ff5db8f3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      #by-unknown
      2⤵
        PID:732
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        #by-unknown
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2492
        • C:\Users\Admin\AppData\Roaming\MSBuild.exe
          "C:\Users\Admin\AppData\Roaming\MSBuild.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4988

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\MSBuild.exe

      Filesize

      256KB

      MD5

      8fdf47e0ff70c40ed3a17014aeea4232

      SHA1

      e6256a0159688f0560b015da4d967f41cbf8c9bd

      SHA256

      ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82

      SHA512

      bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be

    • memory/2492-9-0x0000000074FC0000-0x0000000075770000-memory.dmp

      Filesize

      7.7MB

    • memory/2492-8-0x00000000058B0000-0x0000000005942000-memory.dmp

      Filesize

      584KB

    • memory/2492-21-0x0000000074FC0000-0x0000000075770000-memory.dmp

      Filesize

      7.7MB

    • memory/2492-5-0x0000000074FC0000-0x0000000075770000-memory.dmp

      Filesize

      7.7MB

    • memory/2492-10-0x0000000005970000-0x000000000597A000-memory.dmp

      Filesize

      40KB

    • memory/2492-7-0x0000000005F60000-0x0000000006504000-memory.dmp

      Filesize

      5.6MB

    • memory/2492-2-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB

    • memory/4444-0-0x0000000074FCE000-0x0000000074FCF000-memory.dmp

      Filesize

      4KB

    • memory/4444-6-0x0000000074FC0000-0x0000000075770000-memory.dmp

      Filesize

      7.7MB

    • memory/4444-1-0x0000000000700000-0x0000000000748000-memory.dmp

      Filesize

      288KB

    • memory/4444-4-0x0000000074FC0000-0x0000000075770000-memory.dmp

      Filesize

      7.7MB

    • memory/4988-23-0x0000000074F90000-0x000000007503B000-memory.dmp

      Filesize

      684KB

    • memory/4988-25-0x0000000002E60000-0x0000000002E7A000-memory.dmp

      Filesize

      104KB

    • memory/4988-26-0x00000000054B0000-0x000000000560A000-memory.dmp

      Filesize

      1.4MB

    • memory/4988-24-0x0000000000AD0000-0x0000000000B10000-memory.dmp

      Filesize

      256KB

    • memory/4988-28-0x0000000074F90000-0x000000007503B000-memory.dmp

      Filesize

      684KB