Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
18-04-2022 08:09
General
-
Target
477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe
-
Size
220KB
-
MD5
3829791a486b0b9ccb80ffcb7177c19c
-
SHA1
63b775ca11d595d65b8dfa4215823e7cb98c55af
-
SHA256
477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279
-
SHA512
f1d6950caf18ae7b3f68c6cecded468a706a08ec6a33d6ea29d21f6d120badcb020ae89a3c0be2fadd64424cc931724dbda3b0bd0c4b23f161ab86bde57b4d66
Malware Config
Signatures
-
CrimsonRAT Main Payload 2 IoCs
-
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe"C:\Users\Admin\AppData\Local\Temp\477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Paints\athvindaur.exe"C:\ProgramData\Paints\athvindaur.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.5MB
MD59ffd75516536c9e9f0e6a4cbefe24dcb
SHA15037f1297c44da969bbe30f3139a79933ae9a371
SHA2566514d2900609c10b2abd5fec18f8938f88a050cde56f51633b93bd0fa6d1b1df
SHA512ac678c0d96e02aac671a5290a5d28d3be7679999974d467f998e06ca1008779b8c78302bcb858b7c6e0f81fd4a07922d1bde32088f1c3c906696aa66486ec709
-
Filesize
10.5MB
MD59ffd75516536c9e9f0e6a4cbefe24dcb
SHA15037f1297c44da969bbe30f3139a79933ae9a371
SHA2566514d2900609c10b2abd5fec18f8938f88a050cde56f51633b93bd0fa6d1b1df
SHA512ac678c0d96e02aac671a5290a5d28d3be7679999974d467f998e06ca1008779b8c78302bcb858b7c6e0f81fd4a07922d1bde32088f1c3c906696aa66486ec709
-
Filesize
8KB
-
Filesize
8KB
-
-
Filesize
10.6MB
-
Filesize
10.8MB
-
Filesize
8KB