crimsonrat | 1cb726eab6f36af73e6b0ed97223d8f063f8209d2c25bed39f010b4043b2b8a1

General

Target

1cb726eab6f36af73e6b0ed97223d8f063f8209d2c25bed39f010b4043b2b8a1.doc
Size

426KB
MD5

b3f8eee133ae385d9c7655aae033ca3e
SHA1

d5186e2c17ef6a86aea3020e3bf7799af2e719b8
SHA256

1cb726eab6f36af73e6b0ed97223d8f063f8209d2c25bed39f010b4043b2b8a1
SHA512

256c3fe106171cfb6eba63913f7ce1d89b15c579647d839706d59f4dc47bbc22aa17b33aef35edc5f3dce9dc6f101c3848d74661d217378b73761adbfc9b06e3

Score

10^/10

Malware Config

Signatures

CrimsonRAT Main Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab61-299.dat	family_crimsonrat
behavioral2/files/0x000500000001ab61-298.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat

Executes dropped EXE 1 IoCs

pid	Process
4028	ulhtagnias.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2860	WINWORD.EXE
2860	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2860	WINWORD.EXE
2860	WINWORD.EXE
2860	WINWORD.EXE
2860	WINWORD.EXE
2860	WINWORD.EXE
2860	WINWORD.EXE
2860	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 4028	2860	WINWORD.EXE	74
PID 2860 wrote to memory of 4028	2860	WINWORD.EXE	74

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1cb726eab6f36af73e6b0ed97223d8f063f8209d2c25bed39f010b4043b2b8a1.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\ProgramData\DeIA-WIR\ulhtagnias.exe
  C:\ProgramData\DeIA-WIR\ulhtagnias.exe
  2⤵
  - Executes dropped EXE
  PID:4028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-118-0x00007FF8726E0000-0x00007FF8726F0000-memory.dmp

Filesize
64KB

Download
memory/2860-119-0x00007FF8726E0000-0x00007FF8726F0000-memory.dmp

Filesize
64KB

Download
memory/2860-120-0x00007FF8726E0000-0x00007FF8726F0000-memory.dmp

Filesize
64KB

Download
memory/2860-121-0x00007FF8726E0000-0x00007FF8726F0000-memory.dmp

Filesize
64KB

Download
memory/2860-122-0x00007FF8726E0000-0x00007FF8726F0000-memory.dmp

Filesize
64KB

Download
memory/2860-125-0x00007FF86F1F0000-0x00007FF86F200000-memory.dmp

Filesize
64KB

Download
memory/2860-126-0x00007FF86F1F0000-0x00007FF86F200000-memory.dmp

Filesize
64KB

Download
memory/2860-259-0x000001CCD96D0000-0x000001CCD96D4000-memory.dmp

Filesize
16KB

Download
memory/4028-300-0x0000000002E40000-0x0000000002E42000-memory.dmp

Filesize
8KB

Download
memory/4028-311-0x0000000002E42000-0x0000000002E44000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads