crimsonrat | e881c562ad195b51c9800bc32e8f170db651a7a97a9b3cc1304e80661e156c9f

Analysis

max time kernel
152s
max time network
196s
platform
windows10_x64
resource
win10-en-20211208
submitted
21-01-2022 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

scan0001/scan0001.exe
Size

289KB
MD5

2cd6db80e8dadce0c00f2417b6dedaf4
SHA1

488f62cab74c7754fe8736b0fe8c12c75065789e
SHA256

b9446d663f2aef34efdb579ae02e62923b5c3bc02b9d0fe537f5974ae439a422
SHA512

a5373990db293797347fe054333ba66dadc4eb8551515a9e67652219240f0cee3112969b3087df5a18e5fe9ccc525bfb7091356ecef293b4053b8f6a18646d63

Score

10^/10

crimsonrat rat

Malware Config

Signatures

CrimsonRAT Main Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab30-117.dat	family_crimsonrat
behavioral2/files/0x000500000001ab30-118.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat

Executes dropped EXE 1 IoCs

pid	Process
4088	nirtbivaes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 4088	2736	scan0001.exe	71
PID 2736 wrote to memory of 4088	2736	scan0001.exe	71

C:\Users\Admin\AppData\Local\Temp\scan0001\scan0001.exe
"C:\Users\Admin\AppData\Local\Temp\scan0001\scan0001.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\ProgramData\Ladhnara\nirtbivaes.exe
  "C:\ProgramData\Ladhnara\nirtbivaes.exe"
  2⤵
  - Executes dropped EXE
  PID:4088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2736-115-0x000002A17D5E0000-0x000002A17D630000-memory.dmp

Filesize
320KB

Download
memory/2736-116-0x000002A17FDD0000-0x000002A17FDD2000-memory.dmp

Filesize
8KB

Download
memory/4088-119-0x0000022317300000-0x0000022317CC2000-memory.dmp

Filesize
9.8MB

Download
memory/4088-120-0x0000022332380000-0x0000022332382000-memory.dmp

Filesize
8KB

Download