Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 22:52
Static task
static1
Behavioral task
behavioral1
Sample
Personal Data/Personal Data.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Personal Data/Personal Data.exe
Resource
win10-en-20211208
General
-
Target
Personal Data/Personal Data.exe
-
Size
314KB
-
MD5
9057a26d250fa33e7366e7cb8480cf51
-
SHA1
f01e6154c079cf277c9c6f3c42a5c52e4e6a83de
-
SHA256
68253af6013d22553f3e87b8fd59dfade5c7f120b07ea679b041dcdcb845885a
-
SHA512
690dfa2f640dbc7c93933f5c8156234e364a67c5146b757dcd3ae0e3c3539a11a32e2eaf2ecd880c7edb17b9938ec5ba0c52d76ce339958e3b3ee5c966b1ba40
Malware Config
Signatures
-
CrimsonRAT Main Payload 2 IoCs
Processes:
resource yara_rule C:\ProgramData\Ladhnara\nirtbivaes.exe family_crimsonrat C:\ProgramData\Ladhnara\nirtbivaes.exe family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
Processes:
nirtbivaes.exepid process 820 nirtbivaes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Personal Data.exedescription pid process target process PID 368 wrote to memory of 820 368 Personal Data.exe nirtbivaes.exe PID 368 wrote to memory of 820 368 Personal Data.exe nirtbivaes.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Personal Data\Personal Data.exe"C:\Users\Admin\AppData\Local\Temp\Personal Data\Personal Data.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\ProgramData\Ladhnara\nirtbivaes.exe"C:\ProgramData\Ladhnara\nirtbivaes.exe"2⤵
- Executes dropped EXE
PID:820
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c1a8625fd15f04171bd32a9d95ffba5b
SHA1d960f728e3312447063d209e6534bc28f615df9f
SHA256451bb1928d4ecfcbc351c6859614f64d3648d4f4fc8a50f270542d6a07512697
SHA512d648fb73d31b7ccb79218351c6fecd70df6a55f56c7e16d4ca6f932b761032d52bb4cea7fce73a4ae1b5b205bacd0b631349c11efa3f2b7958a6e4323fb1ebe0
-
MD5
c1a8625fd15f04171bd32a9d95ffba5b
SHA1d960f728e3312447063d209e6534bc28f615df9f
SHA256451bb1928d4ecfcbc351c6859614f64d3648d4f4fc8a50f270542d6a07512697
SHA512d648fb73d31b7ccb79218351c6fecd70df6a55f56c7e16d4ca6f932b761032d52bb4cea7fce73a4ae1b5b205bacd0b631349c11efa3f2b7958a6e4323fb1ebe0