Analysis
-
max time kernel
140s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 23:02
Static task
static1
Behavioral task
behavioral1
Sample
dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe
Resource
win10-en-20211208
General
-
Target
dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe
-
Size
387KB
-
MD5
2a82b0c4a6d1e0b685e15ee159324c28
-
SHA1
1dd115a3b1e39dca45e07bf44d76bd3f83e624f5
-
SHA256
dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e
-
SHA512
e64676c84a3a7ff8c6a9129a5c9c8fe40ac0287f6c41fe94b3b609b01917d234a032bb19a0be737eabd968714dba38715a4e8016da6ba968f454a0969a4e0e37
Malware Config
Signatures
-
CrimsonRAT Main Payload 2 IoCs
Processes:
resource yara_rule C:\ProgramData\Ladhnara\nirtbivaes.exe family_crimsonrat C:\ProgramData\Ladhnara\nirtbivaes.exe family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
Processes:
nirtbivaes.exepid process 652 nirtbivaes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exedescription pid process target process PID 2452 wrote to memory of 652 2452 dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe nirtbivaes.exe PID 2452 wrote to memory of 652 2452 dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe nirtbivaes.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe"C:\Users\Admin\AppData\Local\Temp\dfa54dc6c171740352006b7125219b1fd9cd1403be4a3440c1ad1acb1b42d37e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\ProgramData\Ladhnara\nirtbivaes.exe"C:\ProgramData\Ladhnara\nirtbivaes.exe"2⤵
- Executes dropped EXE
PID:652
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c1a8625fd15f04171bd32a9d95ffba5b
SHA1d960f728e3312447063d209e6534bc28f615df9f
SHA256451bb1928d4ecfcbc351c6859614f64d3648d4f4fc8a50f270542d6a07512697
SHA512d648fb73d31b7ccb79218351c6fecd70df6a55f56c7e16d4ca6f932b761032d52bb4cea7fce73a4ae1b5b205bacd0b631349c11efa3f2b7958a6e4323fb1ebe0
-
MD5
c1a8625fd15f04171bd32a9d95ffba5b
SHA1d960f728e3312447063d209e6534bc28f615df9f
SHA256451bb1928d4ecfcbc351c6859614f64d3648d4f4fc8a50f270542d6a07512697
SHA512d648fb73d31b7ccb79218351c6fecd70df6a55f56c7e16d4ca6f932b761032d52bb4cea7fce73a4ae1b5b205bacd0b631349c11efa3f2b7958a6e4323fb1ebe0