crimsonrat | 0172bec4d945add9f12ce4d7d23f0e0da1ced677e89bfc132b000d444876cb41

General

Target

0172bec4d945add9f12ce4d7d23f0e0da1ced677e89bfc132b000d444876cb41.doc
Size

566KB
MD5

cbfae579a25df1e2fe0e02934efd65dc
SHA1

54c987ddc4e08defe2cee3882a2b729d55aef3ce
SHA256

0172bec4d945add9f12ce4d7d23f0e0da1ced677e89bfc132b000d444876cb41
SHA512

d9df94d65771ac9a136f30bd4d8fc359bda057ea92a4da476f38df2976460a55b3afdb445ff873f71b34ed43f6b0954f0e16e202ff48f59e47bc36b1e736eb9f

Score

10^/10

crimsonrat rat

Malware Config

Signatures

CrimsonRAT Main Payload 2 IoCs

Processes:

resource	yara_rule
C:\ProgramData\Dhoithas\brwmarivas.exe	family_crimsonrat
C:\ProgramData\Dhoithas\brwmarivas.exe	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Executes dropped EXE 2 IoCs

Processes:

rihndimrva.exebrwmarivas.exe

pid process

3236 rihndimrva.exe
1268 brwmarivas.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3236	rihndimrva.exe
1268	brwmarivas.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2748 WINWORD.EXE
2748 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

2748 WINWORD.EXE
2748 WINWORD.EXE
2748 WINWORD.EXE
2748 WINWORD.EXE
2748 WINWORD.EXE
2748 WINWORD.EXE
2748 WINWORD.EXE
2748 WINWORD.EXE

pid	process
2748	WINWORD.EXE
2748	WINWORD.EXE

pid	process
2748	WINWORD.EXE
2748	WINWORD.EXE
2748	WINWORD.EXE
2748	WINWORD.EXE
2748	WINWORD.EXE
2748	WINWORD.EXE
2748	WINWORD.EXE
2748	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXErihndimrva.exe

description	pid	process	target process
PID 2748 wrote to memory of 3236	2748	WINWORD.EXE	rihndimrva.exe
PID 2748 wrote to memory of 3236	2748	WINWORD.EXE	rihndimrva.exe
PID 3236 wrote to memory of 1268	3236	rihndimrva.exe	brwmarivas.exe
PID 3236 wrote to memory of 1268	3236	rihndimrva.exe	brwmarivas.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0172bec4d945add9f12ce4d7d23f0e0da1ced677e89bfc132b000d444876cb41.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\ProgramData\Hblondas\rihndimrva.exe
  C:\ProgramData\Hblondas\rihndimrva.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\ProgramData\Dhoithas\brwmarivas.exe
    "C:\ProgramData\Dhoithas\brwmarivas.exe"
    3⤵
    - Executes dropped EXE
    PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Dhoithas\brwmarivas.exe

MD5
d62156fa2c5bffdc63f0975c5482eab6

SHA1
27cb14bdb9680baa504f9ed8d7b8d5f0f1426533

SHA256
e4fd6452566102631a74d55b5a74b3fc5a2b7431144fb0ecf9f9fe64489a7409

SHA512
784cea7f3c2bc5e78b47960833bfcdc679b8f5d4c46959209bb30e84a7c9f999cfb80a41af19cece8b3e83a529938c1fcf6484005368a130fbeadbb3258c1784

Download Submit
C:\ProgramData\Dhoithas\brwmarivas.exe

MD5
d62156fa2c5bffdc63f0975c5482eab6

SHA1
27cb14bdb9680baa504f9ed8d7b8d5f0f1426533

SHA256
e4fd6452566102631a74d55b5a74b3fc5a2b7431144fb0ecf9f9fe64489a7409

SHA512
784cea7f3c2bc5e78b47960833bfcdc679b8f5d4c46959209bb30e84a7c9f999cfb80a41af19cece8b3e83a529938c1fcf6484005368a130fbeadbb3258c1784

Download Submit
C:\ProgramData\Hblondas\rihndimrva.exe

MD5
6967ee112e93b812947e663a968b48c3

SHA1
59f2388abcb19e10109a6d2571bc9d496af23a67

SHA256
9ec58c011d7efbc2272a0403cd90cb4640858da7b080819737af6f1dd6b6f1e0

SHA512
b92c28437eedb15c54f86e4515b61de603f04b0573b229736a9d16a1183622c78150d43779dffc1a721d33c4ba39bfc1445f16e99dff99c78910abf31943ac61

Download Submit
C:\ProgramData\Hblondas\rihndimrva.exe

MD5
6967ee112e93b812947e663a968b48c3

SHA1
59f2388abcb19e10109a6d2571bc9d496af23a67

SHA256
9ec58c011d7efbc2272a0403cd90cb4640858da7b080819737af6f1dd6b6f1e0

SHA512
b92c28437eedb15c54f86e4515b61de603f04b0573b229736a9d16a1183622c78150d43779dffc1a721d33c4ba39bfc1445f16e99dff99c78910abf31943ac61

Download Submit
memory/1268-317-0x0000000001B82000-0x0000000001B84000-memory.dmp

Filesize
8KB

Download
memory/1268-316-0x0000000001B80000-0x0000000001B82000-memory.dmp

Filesize
8KB

Download
memory/2748-121-0x00007FFFAE560000-0x00007FFFAE570000-memory.dmp

Filesize
64KB

Download
memory/2748-262-0x000001B21D680000-0x000001B21D684000-memory.dmp

Filesize
16KB

Download
memory/2748-126-0x00007FFFAB270000-0x00007FFFAB280000-memory.dmp

Filesize
64KB

Download
memory/2748-125-0x00007FFFAB270000-0x00007FFFAB280000-memory.dmp

Filesize
64KB

Download
memory/2748-124-0x00007FFFAE560000-0x00007FFFAE570000-memory.dmp

Filesize
64KB

Download
memory/2748-118-0x00007FFFAE560000-0x00007FFFAE570000-memory.dmp

Filesize
64KB

Download
memory/2748-120-0x00007FFFAE560000-0x00007FFFAE570000-memory.dmp

Filesize
64KB

Download
memory/2748-119-0x00007FFFAE560000-0x00007FFFAE570000-memory.dmp

Filesize
64KB

Download
memory/3236-276-0x0000000002600000-0x0000000002602000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads