Analysis

  • max time kernel
    157s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    30-01-2022 15:09

General

  • Target

    Coast Guard HQ 10.exe

  • Size

    1.0MB

  • MD5

    b7c83538606a08f71107a5202acdb57a

  • SHA1

    4bb1c28653a1754fd71d57d6deb51d281c21b43d

  • SHA256

    7de78f7c806f828ef071a103b7be87636414635e008ea2463bf33077a466140a

  • SHA512

    428fe43f1a9e9b7f81d68ebc1c1df9bd1eae7b25144d39def9f524a0250b39012b6c1d2044d4530d8413039d514da8148847018d216012d5cf560632587e4afd

Score
10/10

Malware Config

Signatures

  • CrimsonRAT Main Payload 2 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Coast Guard HQ 10.exe
    "C:\Users\Admin\AppData\Local\Temp\Coast Guard HQ 10.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\ProgramData\Rellhars\rvlrarhsma.exe
      "C:\ProgramData\Rellhars\rvlrarhsma.exe"
      2⤵
      • Executes dropped EXE
      PID:1204
    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Documents\Coast Guard HQ 10-4 .pdf"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1388

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1204-58-0x0000000002890000-0x0000000002892000-memory.dmp

    Filesize

    8KB

  • memory/1204-59-0x000007FEEA990000-0x000007FEEBA26000-memory.dmp

    Filesize

    16.6MB

  • memory/1204-61-0x0000000002896000-0x00000000028B5000-memory.dmp

    Filesize

    124KB

  • memory/1388-60-0x0000000075D61000-0x0000000075D63000-memory.dmp

    Filesize

    8KB

  • memory/1712-54-0x0000000000070000-0x0000000000182000-memory.dmp

    Filesize

    1.1MB

  • memory/1712-55-0x000000001B250000-0x000000001B252000-memory.dmp

    Filesize

    8KB