Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 22:57
Static task
static1
Behavioral task
behavioral1
Sample
MoI Operation/MoI Operation.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
MoI Operation/MoI Operation.exe
Resource
win10-en-20211208
General
-
Target
MoI Operation/MoI Operation.exe
-
Size
309KB
-
MD5
2a2088cc646b984cb3d75d18c8708eb5
-
SHA1
20ceef8731d905794c8d7a14f4ecf9fb5aa29e28
-
SHA256
5a449782c6d286a5af7fd5cbab5d5d46dd4dd153cbc46e4aeae0ea54f2785980
-
SHA512
cc23d711d756ca322786d0327b017af5e457b2ac144a03cdff9456164bd58e5dfa0b5ac6df02c9a3d7036cd82a29278eed055357e7080797673aaed95886de1d
Malware Config
Signatures
-
CrimsonRAT Main Payload 2 IoCs
Processes:
resource yara_rule C:\ProgramData\Ladhnara\nirtbivaes.exe family_crimsonrat C:\ProgramData\Ladhnara\nirtbivaes.exe family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
Processes:
nirtbivaes.exepid process 1184 nirtbivaes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
MoI Operation.exedescription pid process target process PID 2432 wrote to memory of 1184 2432 MoI Operation.exe nirtbivaes.exe PID 2432 wrote to memory of 1184 2432 MoI Operation.exe nirtbivaes.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MoI Operation\MoI Operation.exe"C:\Users\Admin\AppData\Local\Temp\MoI Operation\MoI Operation.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\ProgramData\Ladhnara\nirtbivaes.exe"C:\ProgramData\Ladhnara\nirtbivaes.exe"2⤵
- Executes dropped EXE
PID:1184
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c1a8625fd15f04171bd32a9d95ffba5b
SHA1d960f728e3312447063d209e6534bc28f615df9f
SHA256451bb1928d4ecfcbc351c6859614f64d3648d4f4fc8a50f270542d6a07512697
SHA512d648fb73d31b7ccb79218351c6fecd70df6a55f56c7e16d4ca6f932b761032d52bb4cea7fce73a4ae1b5b205bacd0b631349c11efa3f2b7958a6e4323fb1ebe0
-
MD5
c1a8625fd15f04171bd32a9d95ffba5b
SHA1d960f728e3312447063d209e6534bc28f615df9f
SHA256451bb1928d4ecfcbc351c6859614f64d3648d4f4fc8a50f270542d6a07512697
SHA512d648fb73d31b7ccb79218351c6fecd70df6a55f56c7e16d4ca6f932b761032d52bb4cea7fce73a4ae1b5b205bacd0b631349c11efa3f2b7958a6e4323fb1ebe0