Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
170s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30/01/2022, 15:29
Static task
static1
Behavioral task
behavioral1
Sample
386ed7ba502e7bf0e60c546476c1c762cbc951eb2a2ba1f5b505be08d60310ef.xls
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
386ed7ba502e7bf0e60c546476c1c762cbc951eb2a2ba1f5b505be08d60310ef.xls
Resource
win10-en-20211208
General
-
Target
386ed7ba502e7bf0e60c546476c1c762cbc951eb2a2ba1f5b505be08d60310ef.xls
-
Size
401KB
-
MD5
02ba9703d1f250b411ea4c868d17fd2e
-
SHA1
27d7eab43b66abd73cdc8da304dbb2daa9842df0
-
SHA256
386ed7ba502e7bf0e60c546476c1c762cbc951eb2a2ba1f5b505be08d60310ef
-
SHA512
c2803749c6dd777f02312ee635c12930082343eab4153c3691cf8bcfe8ec0925d134e094bffee2ceb918a58d59176f07b43fb7b0ba8573325a63eefca487f24c
Malware Config
Signatures
-
CrimsonRAT Main Payload 2 IoCs
resource yara_rule behavioral2/files/0x000500000001ab2a-308.dat family_crimsonrat behavioral2/files/0x000500000001ab2a-311.dat family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
pid Process 580 hargardius.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2636 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 25 IoCs
pid Process 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE 2636 EXCEL.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2636 wrote to memory of 580 2636 EXCEL.EXE 71 PID 2636 wrote to memory of 580 2636 EXCEL.EXE 71 PID 2636 wrote to memory of 580 2636 EXCEL.EXE 71
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\386ed7ba502e7bf0e60c546476c1c762cbc951eb2a2ba1f5b505be08d60310ef.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\ProgramData\Mldhrab\hargardius.exeC:\ProgramData\Mldhrab\hargardius.exe2⤵
- Executes dropped EXE
PID:580
-