Analysis
-
max time kernel
151s -
max time network
129s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-01-2022 23:02
Static task
static1
Behavioral task
behavioral1
Sample
dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe
Resource
win10-en-20211208
General
-
Target
dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe
-
Size
387KB
-
MD5
2a82b0c4a6d1e0b685e15ee159324c28
-
SHA1
1dd115a3b1e39dca45e07bf44d76bd3f83e624f5
-
SHA256
dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e
-
SHA512
e64676c84a3a7ff8c6a9129a5c9c8fe40ac0287f6c41fe94b3b609b01917d234a032bb19a0be737eabd968714dba38715a4e8016da6ba968f454a0969a4e0e37
Malware Config
Signatures
-
CrimsonRAT Main Payload 2 IoCs
Processes:
resource yara_rule C:\ProgramData\Ladhnara\nirtbivaes.exe family_crimsonrat C:\ProgramData\Ladhnara\nirtbivaes.exe family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
Processes:
nirtbivaes.exepid process 1376 nirtbivaes.exe -
Drops file in Program Files directory 2 IoCs
Processes:
dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exedescription ioc process File created C:\PROGRA~3\Ladhnara\nirtbivaes.exe dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe File opened for modification C:\PROGRA~3\Ladhnara\nirtbivaes.exe dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exedescription pid process target process PID 1412 wrote to memory of 1376 1412 dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe nirtbivaes.exe PID 1412 wrote to memory of 1376 1412 dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe nirtbivaes.exe PID 1412 wrote to memory of 1376 1412 dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe nirtbivaes.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe"C:\Users\Admin\AppData\Local\Temp\dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\ProgramData\Ladhnara\nirtbivaes.exe"C:\ProgramData\Ladhnara\nirtbivaes.exe"2⤵
- Executes dropped EXE
PID:1376
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
8d42aaeaa6fc19c74b744ccf20e51150
SHA1e350b04dc8a3005649c8d54716b740c37d12dd53
SHA25647b99e50430e9abad7326d1837ecdda5f995112b0b12406d23df5ef603d52a4e
SHA512818fb089c26750dea3f1ef5aafed065398fa0be2106e37bf5727e3c30868f9e5af71484c837371aaa09de4fbd36d345c2a813dd1f6e65cfff8ff01bebab80d19
-
MD5
8d42aaeaa6fc19c74b744ccf20e51150
SHA1e350b04dc8a3005649c8d54716b740c37d12dd53
SHA25647b99e50430e9abad7326d1837ecdda5f995112b0b12406d23df5ef603d52a4e
SHA512818fb089c26750dea3f1ef5aafed065398fa0be2106e37bf5727e3c30868f9e5af71484c837371aaa09de4fbd36d345c2a813dd1f6e65cfff8ff01bebab80d19