Analysis
-
max time kernel
152s -
max time network
196s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 22:56
Static task
static1
Behavioral task
behavioral1
Sample
scan0001/scan0001.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
scan0001/scan0001.exe
Resource
win10-en-20211208
General
-
Target
scan0001/scan0001.exe
-
Size
289KB
-
MD5
2cd6db80e8dadce0c00f2417b6dedaf4
-
SHA1
488f62cab74c7754fe8736b0fe8c12c75065789e
-
SHA256
b9446d663f2aef34efdb579ae02e62923b5c3bc02b9d0fe537f5974ae439a422
-
SHA512
a5373990db293797347fe054333ba66dadc4eb8551515a9e67652219240f0cee3112969b3087df5a18e5fe9ccc525bfb7091356ecef293b4053b8f6a18646d63
Malware Config
Signatures
-
CrimsonRAT Main Payload 2 IoCs
Processes:
resource yara_rule C:\ProgramData\Ladhnara\nirtbivaes.exe family_crimsonrat C:\ProgramData\Ladhnara\nirtbivaes.exe family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
Processes:
nirtbivaes.exepid process 4088 nirtbivaes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
scan0001.exedescription pid process target process PID 2736 wrote to memory of 4088 2736 scan0001.exe nirtbivaes.exe PID 2736 wrote to memory of 4088 2736 scan0001.exe nirtbivaes.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c1a8625fd15f04171bd32a9d95ffba5b
SHA1d960f728e3312447063d209e6534bc28f615df9f
SHA256451bb1928d4ecfcbc351c6859614f64d3648d4f4fc8a50f270542d6a07512697
SHA512d648fb73d31b7ccb79218351c6fecd70df6a55f56c7e16d4ca6f932b761032d52bb4cea7fce73a4ae1b5b205bacd0b631349c11efa3f2b7958a6e4323fb1ebe0
-
MD5
c1a8625fd15f04171bd32a9d95ffba5b
SHA1d960f728e3312447063d209e6534bc28f615df9f
SHA256451bb1928d4ecfcbc351c6859614f64d3648d4f4fc8a50f270542d6a07512697
SHA512d648fb73d31b7ccb79218351c6fecd70df6a55f56c7e16d4ca6f932b761032d52bb4cea7fce73a4ae1b5b205bacd0b631349c11efa3f2b7958a6e4323fb1ebe0