Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-01-2022 00:44
General
-
Target
Guidelines.xlam
-
Size
127KB
-
MD5
e0f6bcdb71df502f7aefe22db8207a69
-
SHA1
9f7357219cbfb5b940d5809f8564a6bb821fa036
-
SHA256
0335de8eadbbd5dc7cbe92ef869bcea6f6596ac39a38680142c982ec6e97ecde
-
SHA512
ea9fc5fe2bcd8a225c7f7f7b8ea832e3d143278a07c6264edaf9476fb5e7852efdd9b3dbcde6e211ccb1e6d011b11845def65af58e9298a01b3067a05200d7cc
Malware Config
Signatures
-
CrimsonRAT Main Payload 2 IoCs
-
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Guidelines.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Glhvadia\hbraeiwas.exeC:\Users\Admin\Glhvadia\hbraeiwas.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Hdlharas\dlrarhsiva.exe"C:\ProgramData\Hdlharas\dlrarhsiva.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
b35ab8d47748801afa154144c2891dc4
SHA1c2c356c1a6abd7858d9a143da35c7fadff9f8edb
SHA25615c45d634c70f0604cfe30806320090c66a65d8f8a26303db3c9c15bf3cc950c
SHA512a89686b0e7bb0b7ab6281a69448cc050ce3fe6a5c56ec9f5f2869106b3e2560a84554463bb9bb277d7f6da5a90a9f07f8ab5369f793fbb21dab56d868ae1ed45
-
MD5
b35ab8d47748801afa154144c2891dc4
SHA1c2c356c1a6abd7858d9a143da35c7fadff9f8edb
SHA25615c45d634c70f0604cfe30806320090c66a65d8f8a26303db3c9c15bf3cc950c
SHA512a89686b0e7bb0b7ab6281a69448cc050ce3fe6a5c56ec9f5f2869106b3e2560a84554463bb9bb277d7f6da5a90a9f07f8ab5369f793fbb21dab56d868ae1ed45
-
MD5
4663018621abd6313f9edb03c0737517
SHA1a9dd4c0303b261344d469362bd80c4e366e79692
SHA256e2200fa8b8c4757039e3f78536d9442817331f530e4348e08f02af753e7ae024
SHA51264d44f463b2d855c17b495ec056998b6f522f5078743621322f1cb574acf2ead445b0fe0f853a420941dfae2c09f5965ea383e48af74479d9c6c5a14c44a8f55
-
MD5
4663018621abd6313f9edb03c0737517
SHA1a9dd4c0303b261344d469362bd80c4e366e79692
SHA256e2200fa8b8c4757039e3f78536d9442817331f530e4348e08f02af753e7ae024
SHA51264d44f463b2d855c17b495ec056998b6f522f5078743621322f1cb574acf2ead445b0fe0f853a420941dfae2c09f5965ea383e48af74479d9c6c5a14c44a8f55
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB