Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
21-12-2023 16:12
General
-
Target
netflix_christmas_offer_for_old_users.xlam
-
Size
5.1MB
-
MD5
9f066a62e22b98b0fad7fedfdee68b52
-
SHA1
e82bda281cd56e2515f3b351f8cb7d074986ed13
-
SHA256
2b7c1c57725451109a1a9217aa02507a0f37e67b46f91d5d153bbb1d0e4122b4
-
SHA512
53f1e9944ee3ee547900efca6b6a23e735d82b63c9e753c3b81de53a1bf113e81733ba79976f9a469c698dc79b88d34faec6dbc23561878c18242389685b0f4f
-
SSDEEP
98304:jV4oyAgZvd4DsMtu/oYUT5FWSQERe4QBUfX9I5CvKc4lROdy60zQ:RPiKDu/7QZQ2HQUfX6gN4lROdZ0zQ
Malware Config
Extracted
crimsonrat
167.160.166.1
Signatures
-
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SetWindowsHookEx 19 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\netflix_christmas_offer_for_old_users.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\231612\jevisvmnrav.comC:\Users\Admin\Documents\231612\jevisvmnrav.com2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153KB
MD5c0a028c7292441bf17d7068acab7cfd6
SHA135aba987e63bb6133b5fe6943d5e7faac3aed475
SHA256f0d867bbfcc1da5d5a0d19713661e66aa975b02453a51f5518c46a0274015d05
SHA512e24f48fb74a1d2162935f01f3ab42ac729dcf235b26c8f991bca74dd5d14500969fa18365ee471c0cd8b74a551b357f05bfddbcc0ac6da90d7fd258178082d95
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
120KB
MD50ec66f5413c0c2e68f216a2a18eb93a6
SHA14abf2b28d0c3e7b488df2330fba6d8f3ba03f9a6
SHA256c50bd848a29cf7a809a4c99045f308543f80fd7a0a950da21f8d9fc470ba9229
SHA512401563f1455bfc1a6f9f5fa6c5233828d0badc96cacf3d9452cc422e1d84cf2890b3aa9bd67f94336f76eb83b84f0a1bf441659bcbe084830f4624f0af0c8d03
-
Filesize
271KB
MD53f3eb4636fbde04470535c28534864e0
SHA185c88b2a775a0b877f5d4dd735e6ef5781831990
SHA256b4b5212953bc0366af3ff1abe8a293bca269dd67dafde37bf579371657dafa74
SHA512bfb7ea8ba434aa159b2515438c2787d6a04e58344e11e54bd5f8d5b356528fa7c31654678e6b22df6d3e32972e5ce951849324bf842f42dce707956fda5b4837
-
Filesize
258KB
MD5c3bb819c967c7c99f4857d56cf386df1
SHA1d5c5e7b53d7f7250529730351209245d14ed8d66
SHA2568515ec4b9ba0ccab15dbee82dcdb26ed5501aca4105785f8afb633f52fbee238
SHA5127d5bc5c7879029e7f04118c222ed45aa54680bbf77205953219f9351437e556d5165a6a8bb4f3c650f9de9c59b51787cad09e0ca34b17c0f8425b82d8b997121
-
Filesize
124KB
MD596c67b4a037732b008466568e2a70a4e
SHA1a40ffacd71fdfd06be04643af03929f5be41f039
SHA256576935e605536e659442439e016bf05e68d3d556bf3978e63fe3cc0be609a71d
SHA5128e4ba719b276c74c68d1464968e819323bd74a3f2a0a46732b6ceee6cd1ee7118cccd2bb3eb0a71c08fac37aeb59b6a5b5446a1ec3d1d5d9b63845042988e204
-
Filesize
124KB
MD54ba87cb59ad69ca70246cbdeef80d5d0
SHA19ac22b4b3f15594f79f338bd1c52bc38637dc00d
SHA256bf9035b7bab9ff7be87b53d535d76df66b2101f067f3f11ffe67d0865f115ac4
SHA5123edfad2e8bcf58b6d73050c62bb94121f52e18d3536151d01855b6b3aae772ec18d9036fc4ab854a44b5e0c013c78fac3d8fbe03a4ce606537e3b0cc07606d56
-
Filesize
299B
MD584544d82569111767d12019e66416d1e
SHA16f95f4be0de5b2ef6749e80f11813f84473f32e1
SHA256ee9fa12d10c5ee0ae23c711aad3be36f1d99d87934a588aac4ecaf1028bdef16
SHA512018bd3043fa87934e782e035b97ec39c21d7f3fd3e2f54ef8fe1d9dc48c127360ba4b2f97c7bff3c06c2395f13ac1039bfefecbada55df7c688eda8a372fe422
-
Filesize
11KB
MD5b690ff9f6d3b668858d825fa0ce69ed4
SHA1782547cebe8aba85029cde0cd8b3debf9a7b7f14
SHA25601654630570ca2104b401436f82831bf04e284eaf983e1db4443d44969494ad2
SHA512dc42ac00ed88f321648dca7feb7ce80c38c835f7294651104d60a757a5641e612f90ff2edeceb2a734924cf21d584b336f73f05b320dd3f15f97040c2b59843e
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
8.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
16.9MB