Analysis

  • max time kernel
    165s
  • max time network
    186s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    21-01-2022 22:57

General

  • Target

    e63cd1c60fd8d9f2ab6714f371958621f9d500bb09ba3569d0435f8f38960584.exe

  • Size

    89KB

  • MD5

    c2fd45f6342fe183749eed303010965b

  • SHA1

    7bc4e9aba5a79504ab85f15da2f7d15661777394

  • SHA256

    e63cd1c60fd8d9f2ab6714f371958621f9d500bb09ba3569d0435f8f38960584

  • SHA512

    ebba30fb01bee91e02c2aae40cb6bbe7e6c20185b7d624ac96375ffd8e547ee07ed98ceddbeecb5c941c8c1318f951379d08873765e5e28f6449f94d718f64f6

Score
10/10

Malware Config

Signatures

  • CrimsonRAT Main Payload 2 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e63cd1c60fd8d9f2ab6714f371958621f9d500bb09ba3569d0435f8f38960584.exe
    "C:\Users\Admin\AppData\Local\Temp\e63cd1c60fd8d9f2ab6714f371958621f9d500bb09ba3569d0435f8f38960584.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2628
    • C:\ProgramData\Detharis\dhrwarhsav.exe
      "C:\ProgramData\Detharis\dhrwarhsav.exe"
      2⤵
      • Executes dropped EXE
      PID:1716

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Detharis\dhrwarhsav.exe

    MD5

    e0db666fff1c8ac20106aa04b20b7b2e

    SHA1

    9ff84c539401626a0fa95cef4e448e7675785a20

    SHA256

    c22c8d74daac7596b4816de5b7549927a01f65669aed7f52e382d151deb76080

    SHA512

    cac85784d1c46c89e9871e6ae011573b09328b98a6ef85ebc4f73bab3ae5e0ed88d7d13167d466805c3bbf5eb505a239395a06e689c10ca8808a2472b4630e67

  • C:\ProgramData\Detharis\dhrwarhsav.exe

    MD5

    e0db666fff1c8ac20106aa04b20b7b2e

    SHA1

    9ff84c539401626a0fa95cef4e448e7675785a20

    SHA256

    c22c8d74daac7596b4816de5b7549927a01f65669aed7f52e382d151deb76080

    SHA512

    cac85784d1c46c89e9871e6ae011573b09328b98a6ef85ebc4f73bab3ae5e0ed88d7d13167d466805c3bbf5eb505a239395a06e689c10ca8808a2472b4630e67

  • memory/1716-119-0x0000000003080000-0x0000000003082000-memory.dmp

    Filesize

    8KB

  • memory/1716-122-0x0000000003082000-0x0000000003084000-memory.dmp

    Filesize

    8KB

  • memory/2628-115-0x0000000002750000-0x0000000002752000-memory.dmp

    Filesize

    8KB

  • memory/2628-120-0x0000000002752000-0x0000000002754000-memory.dmp

    Filesize

    8KB