Analysis Overview
SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba
Threat Level: Known bad
The file dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba was found to be: Known bad.
Malicious Activity Summary
CrimsonRAT Main Payload
CrimsonRat
Executes dropped EXE
Drops file in Program Files directory
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-01-21 23:03
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-01-21 23:03
Reported
2022-01-21 23:24
Platform
win7-en-20211208
Max time kernel
129s
Max time network
138s
Command Line
Signatures
CrimsonRAT Main Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
CrimsonRat
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\Hdlharas\dlrarhsiva.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\PROGRA~3\Hdlharas\dlrarhsiva.exe | C:\Users\Admin\AppData\Local\Temp\dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe | N/A |
| File opened for modification | C:\PROGRA~3\Hdlharas\dlrarhsiva.exe | C:\Users\Admin\AppData\Local\Temp\dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe | N/A |
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1592 wrote to memory of 572 | N/A | C:\Users\Admin\AppData\Local\Temp\dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe | C:\ProgramData\Hdlharas\dlrarhsiva.exe |
| PID 1592 wrote to memory of 572 | N/A | C:\Users\Admin\AppData\Local\Temp\dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe | C:\ProgramData\Hdlharas\dlrarhsiva.exe |
| PID 1592 wrote to memory of 572 | N/A | C:\Users\Admin\AppData\Local\Temp\dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe | C:\ProgramData\Hdlharas\dlrarhsiva.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe
"C:\Users\Admin\AppData\Local\Temp\dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe"
C:\ProgramData\Hdlharas\dlrarhsiva.exe
"C:\ProgramData\Hdlharas\dlrarhsiva.exe"
Network
| Country | Destination | Domain | Proto |
| FR | 185.136.161.124:6128 | tcp | |
| FR | 185.136.161.124:8761 | tcp | |
| FR | 185.136.161.124:11614 | tcp |
Files
memory/1592-54-0x00000000001E0000-0x00000000001FE000-memory.dmp
memory/1592-55-0x000000001B1E0000-0x000000001B1E2000-memory.dmp
C:\ProgramData\Hdlharas\dlrarhsiva.exe
| MD5 | 64261d5f3b07671f15b7f10f2f78da3f |
| SHA1 | d4f978177394024bb4d0e5b6b972a5f72f830181 |
| SHA256 | 87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad |
| SHA512 | 3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a |
C:\ProgramData\Hdlharas\dlrarhsiva.exe
| MD5 | 64261d5f3b07671f15b7f10f2f78da3f |
| SHA1 | d4f978177394024bb4d0e5b6b972a5f72f830181 |
| SHA256 | 87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad |
| SHA512 | 3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a |
memory/572-58-0x0000000000300000-0x0000000000C14000-memory.dmp
memory/572-59-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp
memory/572-60-0x000000001B940000-0x000000001B942000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-01-21 23:03
Reported
2022-01-21 23:24
Platform
win10-en-20211208
Max time kernel
171s
Max time network
202s
Command Line
Signatures
CrimsonRAT Main Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
CrimsonRat
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\Hdlharas\dlrarhsiva.exe | N/A |
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3168 wrote to memory of 3196 | N/A | C:\Users\Admin\AppData\Local\Temp\dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe | C:\ProgramData\Hdlharas\dlrarhsiva.exe |
| PID 3168 wrote to memory of 3196 | N/A | C:\Users\Admin\AppData\Local\Temp\dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe | C:\ProgramData\Hdlharas\dlrarhsiva.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe
"C:\Users\Admin\AppData\Local\Temp\dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba.exe"
C:\ProgramData\Hdlharas\dlrarhsiva.exe
"C:\ProgramData\Hdlharas\dlrarhsiva.exe"
Network
| Country | Destination | Domain | Proto |
| US | 52.109.8.20:443 | tcp | |
| US | 52.109.8.20:443 | tcp | |
| FR | 185.136.161.124:6128 | tcp | |
| FR | 185.136.161.124:8761 | tcp | |
| FR | 185.136.161.124:11614 | tcp |
Files
memory/3168-115-0x000001E90E330000-0x000001E90E34E000-memory.dmp
memory/3168-116-0x000001E90E6B0000-0x000001E90E6B2000-memory.dmp
C:\ProgramData\Hdlharas\dlrarhsiva.exe
| MD5 | 64261d5f3b07671f15b7f10f2f78da3f |
| SHA1 | d4f978177394024bb4d0e5b6b972a5f72f830181 |
| SHA256 | 87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad |
| SHA512 | 3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a |
C:\ProgramData\Hdlharas\dlrarhsiva.exe
| MD5 | 64261d5f3b07671f15b7f10f2f78da3f |
| SHA1 | d4f978177394024bb4d0e5b6b972a5f72f830181 |
| SHA256 | 87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad |
| SHA512 | 3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a |
memory/3196-119-0x000001BF889C0000-0x000001BF892D4000-memory.dmp
memory/3196-120-0x000001BFA4080000-0x000001BFA4082000-memory.dmp