Analysis
-
max time kernel
171s -
max time network
202s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 23:03
Static task
static1
Behavioral task
behavioral1
Sample
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe
Resource
win10-en-20211208
General
-
Target
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe
-
Size
84KB
-
MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c
-
SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60
-
SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba
-
SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741
Malware Config
Signatures
-
CrimsonRAT Main Payload 2 IoCs
Processes:
resource yara_rule C:\ProgramData\Hdlharas\dlrarhsiva.exe family_crimsonrat C:\ProgramData\Hdlharas\dlrarhsiva.exe family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
Processes:
dlrarhsiva.exepid process 3196 dlrarhsiva.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exedescription pid process target process PID 3168 wrote to memory of 3196 3168 dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe dlrarhsiva.exe PID 3168 wrote to memory of 3196 3168 dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe dlrarhsiva.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe"C:\Users\Admin\AppData\Local\Temp\dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\ProgramData\Hdlharas\dlrarhsiva.exe"C:\ProgramData\Hdlharas\dlrarhsiva.exe"2⤵
- Executes dropped EXE
PID:3196
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
64261d5f3b07671f15b7f10f2f78da3f
SHA1d4f978177394024bb4d0e5b6b972a5f72f830181
SHA25687f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad
SHA5123a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a
-
MD5
64261d5f3b07671f15b7f10f2f78da3f
SHA1d4f978177394024bb4d0e5b6b972a5f72f830181
SHA25687f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad
SHA5123a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a