Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-04-2022 04:18
Static task
static1
Behavioral task
behavioral1
Sample
c2a635767c84df8471d4f614b9c35b2ba75070b0c9f8c3721fc0aaace79dcc73.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c2a635767c84df8471d4f614b9c35b2ba75070b0c9f8c3721fc0aaace79dcc73.exe
Resource
win10v2004-20220414-en
General
-
Target
c2a635767c84df8471d4f614b9c35b2ba75070b0c9f8c3721fc0aaace79dcc73.exe
-
Size
59KB
-
MD5
9882ba138b96b395eea3c3b542633f60
-
SHA1
185ba36c072edb8ed7494e889e88047808ff2f4f
-
SHA256
c2a635767c84df8471d4f614b9c35b2ba75070b0c9f8c3721fc0aaace79dcc73
-
SHA512
c742360bc636925148f29f00ee7407d485b97c1bcffa40b8f92a885cfe7743ea65195d2842844574828c7720c1381b144755e59ded9eff4a97aa7aa127c0e7f4
Malware Config
Signatures
-
CrimsonRAT Main Payload 2 IoCs
resource yara_rule behavioral1/files/0x00080000000122e3-57.dat family_crimsonrat behavioral1/files/0x00080000000122e3-58.dat family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
pid Process 1424 ithmrdrvas.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\PROGRA~3\Dhonvdh\ithmrdrvas.exe c2a635767c84df8471d4f614b9c35b2ba75070b0c9f8c3721fc0aaace79dcc73.exe File created C:\PROGRA~3\Dhonvdh\ithmrdrvas.exe c2a635767c84df8471d4f614b9c35b2ba75070b0c9f8c3721fc0aaace79dcc73.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 908 wrote to memory of 1424 908 c2a635767c84df8471d4f614b9c35b2ba75070b0c9f8c3721fc0aaace79dcc73.exe 28 PID 908 wrote to memory of 1424 908 c2a635767c84df8471d4f614b9c35b2ba75070b0c9f8c3721fc0aaace79dcc73.exe 28 PID 908 wrote to memory of 1424 908 c2a635767c84df8471d4f614b9c35b2ba75070b0c9f8c3721fc0aaace79dcc73.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2a635767c84df8471d4f614b9c35b2ba75070b0c9f8c3721fc0aaace79dcc73.exe"C:\Users\Admin\AppData\Local\Temp\c2a635767c84df8471d4f614b9c35b2ba75070b0c9f8c3721fc0aaace79dcc73.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:908 -
C:\ProgramData\Dhonvdh\ithmrdrvas.exe"C:\ProgramData\Dhonvdh\ithmrdrvas.exe"2⤵
- Executes dropped EXE
PID:1424
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.3MB
MD58930f5a56afe4a9f02c01c6c6b647da0
SHA1b1000f35e9150d59b0849a662d35f69e67294a51
SHA25609aaf5e962480a6412c5523f6705489e5aee2f2bd3e42491074b903d0f5d3d3d
SHA51205ed5347ffd7bfd1692d7f61f1a051d9377710abdd366ef05ca399566d01cb3bb4065a0693f85ca1e5455452ce3cda2a795f73f259ba3158492f2fb62165b1dc
-
Filesize
9.3MB
MD58930f5a56afe4a9f02c01c6c6b647da0
SHA1b1000f35e9150d59b0849a662d35f69e67294a51
SHA25609aaf5e962480a6412c5523f6705489e5aee2f2bd3e42491074b903d0f5d3d3d
SHA51205ed5347ffd7bfd1692d7f61f1a051d9377710abdd366ef05ca399566d01cb3bb4065a0693f85ca1e5455452ce3cda2a795f73f259ba3158492f2fb62165b1dc