Analysis
-
max time kernel
155s -
max time network
155s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 23:44
General
-
Target
67da24711012366322f2e6ab3534d62c064d24dc6e113b6077354c792cc56b71.xlam
-
Size
112KB
-
MD5
1b54bc52032731b5c75b9f74df7e1afe
-
SHA1
cdddaf72deb956e039e5e8c10230d6c872a34e10
-
SHA256
67da24711012366322f2e6ab3534d62c064d24dc6e113b6077354c792cc56b71
-
SHA512
818961365b8dd76b7cdc90e2b00d9419e13de6e0797b9fb012a2b4bcaf4e5856376ebeb216ceb9afe810b34a4227e3222aea85ccc872f7ae013a5b98f46c54d3
Malware Config
Signatures
-
CrimsonRAT Main Payload 2 IoCs
-
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 24 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\67da24711012366322f2e6ab3534d62c064d24dc6e113b6077354c792cc56b71.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Uthmdsa\pnvthirena.exeC:\Users\Admin\Uthmdsa\pnvthirena.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Addobephot\hdlbvarims.exe"C:\ProgramData\Addobephot\hdlbvarims.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c410ef1f5b0ca137ffd993b3569fac88
SHA13b3ad0394f467aca9f81ba7c574b04dc63d5b8e9
SHA2561259ddd540300dbec4d76b5909dad475fa56b3b1837b6c7097d9b42e28d3182c
SHA51248002ffdaf42069aeeed1584af940c03205510c0f3e589962b9e54aaf95ecfe217df6f2c7ee66e2a23e9fa66f709d5ea428ece5403056d1f35e6f631776e66be
-
MD5
c410ef1f5b0ca137ffd993b3569fac88
SHA13b3ad0394f467aca9f81ba7c574b04dc63d5b8e9
SHA2561259ddd540300dbec4d76b5909dad475fa56b3b1837b6c7097d9b42e28d3182c
SHA51248002ffdaf42069aeeed1584af940c03205510c0f3e589962b9e54aaf95ecfe217df6f2c7ee66e2a23e9fa66f709d5ea428ece5403056d1f35e6f631776e66be
-
MD5
af866c374e012be282b3318931307751
SHA1388a3c0773932e4a4471e0250eaef8c90b47685b
SHA256950532180701f8ac033a8796238d7e5b6900bc2652f28e2a44645d3cdabdeded
SHA51268e2adb4cbe0330ec2b260aaf1cb0861c31afffdf8c5cca75f8cc2996550f002256361f1dac873b48ebc0dbce4c536ee2c236eb54f4c58e2a4ac6e19a4998968
-
MD5
af866c374e012be282b3318931307751
SHA1388a3c0773932e4a4471e0250eaef8c90b47685b
SHA256950532180701f8ac033a8796238d7e5b6900bc2652f28e2a44645d3cdabdeded
SHA51268e2adb4cbe0330ec2b260aaf1cb0861c31afffdf8c5cca75f8cc2996550f002256361f1dac873b48ebc0dbce4c536ee2c236eb54f4c58e2a4ac6e19a4998968
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB