Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
07-12-2023 06:22
General
-
Target
Monthly Report MAP.xlam
-
Size
3.4MB
-
MD5
41d801d96c9e27c5ca6c4678ffa2d7e2
-
SHA1
f8c6b5b4c520c2416bea015451cc8aca3283abe6
-
SHA256
a0632cecfd478fbef1a69daae3d760041c6af2cc88965633d3837e076793cc82
-
SHA512
58bfe64961ed881bb1489a5e298f4302d26568c770b5422aff36952514c33c91b588a000554e75581939b98185d2ca7681042e288215e8d62468f028bf8c847c
-
SSDEEP
98304:Wal3ZM+KyXAQ5036pRV4sWWL4lxoeF35abXerDX6:dM+Kg503C74uL4XD8qK
Malware Config
Extracted
crimsonrat
64.188.21.202
Signatures
-
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SetWindowsHookEx 22 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Monthly Report MAP.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\617\itugpisacrev.comC:\Users\Admin\Downloads\617\itugpisacrev.com2⤵
- Executes dropped EXE
-
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22.4MB
MD5c9c802bb6fcfa1c4922fa637a3a8dca1
SHA1fc2a1974925addc9164e9488a5805bb9c397d5e0
SHA25673d192b9b79df57932eb153eb5f6f8c999c9297d54768367a3ecf002950f0bae
SHA512736e2a7a96afb7b7b081352f41da6c21a1015b11e24345e14900e8ea1de55da071cea5ed3e8e0cc80dbe51c61cdf1d5eeef35545ac5ce934dccaf61c4ee48d11
-
Filesize
22.4MB
MD5c9c802bb6fcfa1c4922fa637a3a8dca1
SHA1fc2a1974925addc9164e9488a5805bb9c397d5e0
SHA25673d192b9b79df57932eb153eb5f6f8c999c9297d54768367a3ecf002950f0bae
SHA512736e2a7a96afb7b7b081352f41da6c21a1015b11e24345e14900e8ea1de55da071cea5ed3e8e0cc80dbe51c61cdf1d5eeef35545ac5ce934dccaf61c4ee48d11
-
Filesize
22.4MB
MD5c9c802bb6fcfa1c4922fa637a3a8dca1
SHA1fc2a1974925addc9164e9488a5805bb9c397d5e0
SHA25673d192b9b79df57932eb153eb5f6f8c999c9297d54768367a3ecf002950f0bae
SHA512736e2a7a96afb7b7b081352f41da6c21a1015b11e24345e14900e8ea1de55da071cea5ed3e8e0cc80dbe51c61cdf1d5eeef35545ac5ce934dccaf61c4ee48d11
-
Filesize
3.4MB
MD541d801d96c9e27c5ca6c4678ffa2d7e2
SHA1f8c6b5b4c520c2416bea015451cc8aca3283abe6
SHA256a0632cecfd478fbef1a69daae3d760041c6af2cc88965633d3837e076793cc82
SHA51258bfe64961ed881bb1489a5e298f4302d26568c770b5422aff36952514c33c91b588a000554e75581939b98185d2ca7681042e288215e8d62468f028bf8c847c
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
3.5MB
MD522ec8f10e85d07c61783da6ef409b698
SHA10f1c60575fd3d3e78d8b8d677de32d4a3547ffec
SHA25664c23c177bbeca04906058918c26b80b2fee7774f9ad3682bf14142c8fc32fb0
SHA5128f53f8e29c73fbaf5867b0c55fbf57c1e3a7f1d59008a379b37f0649d7f3660d31ea4d047256dc7d728ed79ae54ebe928eed631a247ec2ae6e84f5e92b44ef70
-
Filesize
3.5MB
MD5c01bae9b26a56b279615f4fe3ed44421
SHA17c4bcb10945441a46241859da769e6ff767a81b9
SHA256eda677d25eea548857ac2cf803e652f776285418e4520dc005b4492c913ecb01
SHA5121a90139d7d666c52f2f730d9c70df4d8735828fda17b232216b5d7bb83d0009d9fd51bd09a46c7f8a4d2051ed06ad6fca127a1438b43362988da84fed1dacaeb
-
Filesize
15KB
MD5e6e7f06b649fc6df7f948d3450a7b344
SHA1fb591934229a5ad5b1aa010d99e9f64fb7dfc9ca
SHA25674e119c485fb71f3b5d5e64a271b8dd8299db5833612aa78400223c2064b2732
SHA512cac4367865c55cb1c4490be6d53ea6a9de36b8360aa74e86118e353c369b4abb065174047c8c83ff7b6cb27d74f6400b51eea296a94b795bc5c9a6e5aac1c7d2
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
4.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
264KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
264KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
4.0MB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
22.5MB
-
Filesize
10.8MB