Analysis
-
max time kernel
165s -
max time network
186s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 22:57
Static task
static1
Behavioral task
behavioral1
Sample
e63cd1c60fd8d9f2ab6714f371958621f9d500bb09ba3569d0435f8f38960584.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e63cd1c60fd8d9f2ab6714f371958621f9d500bb09ba3569d0435f8f38960584.exe
Resource
win10-en-20211208
General
-
Target
e63cd1c60fd8d9f2ab6714f371958621f9d500bb09ba3569d0435f8f38960584.exe
-
Size
89KB
-
MD5
c2fd45f6342fe183749eed303010965b
-
SHA1
7bc4e9aba5a79504ab85f15da2f7d15661777394
-
SHA256
e63cd1c60fd8d9f2ab6714f371958621f9d500bb09ba3569d0435f8f38960584
-
SHA512
ebba30fb01bee91e02c2aae40cb6bbe7e6c20185b7d624ac96375ffd8e547ee07ed98ceddbeecb5c941c8c1318f951379d08873765e5e28f6449f94d718f64f6
Malware Config
Signatures
-
CrimsonRAT Main Payload 2 IoCs
Processes:
resource yara_rule C:\ProgramData\Detharis\dhrwarhsav.exe family_crimsonrat C:\ProgramData\Detharis\dhrwarhsav.exe family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
Processes:
dhrwarhsav.exepid process 1716 dhrwarhsav.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
e63cd1c60fd8d9f2ab6714f371958621f9d500bb09ba3569d0435f8f38960584.exedescription pid process target process PID 2628 wrote to memory of 1716 2628 e63cd1c60fd8d9f2ab6714f371958621f9d500bb09ba3569d0435f8f38960584.exe dhrwarhsav.exe PID 2628 wrote to memory of 1716 2628 e63cd1c60fd8d9f2ab6714f371958621f9d500bb09ba3569d0435f8f38960584.exe dhrwarhsav.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e63cd1c60fd8d9f2ab6714f371958621f9d500bb09ba3569d0435f8f38960584.exe"C:\Users\Admin\AppData\Local\Temp\e63cd1c60fd8d9f2ab6714f371958621f9d500bb09ba3569d0435f8f38960584.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\ProgramData\Detharis\dhrwarhsav.exe"C:\ProgramData\Detharis\dhrwarhsav.exe"2⤵
- Executes dropped EXE
PID:1716
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
e0db666fff1c8ac20106aa04b20b7b2e
SHA19ff84c539401626a0fa95cef4e448e7675785a20
SHA256c22c8d74daac7596b4816de5b7549927a01f65669aed7f52e382d151deb76080
SHA512cac85784d1c46c89e9871e6ae011573b09328b98a6ef85ebc4f73bab3ae5e0ed88d7d13167d466805c3bbf5eb505a239395a06e689c10ca8808a2472b4630e67
-
MD5
e0db666fff1c8ac20106aa04b20b7b2e
SHA19ff84c539401626a0fa95cef4e448e7675785a20
SHA256c22c8d74daac7596b4816de5b7549927a01f65669aed7f52e382d151deb76080
SHA512cac85784d1c46c89e9871e6ae011573b09328b98a6ef85ebc4f73bab3ae5e0ed88d7d13167d466805c3bbf5eb505a239395a06e689c10ca8808a2472b4630e67