Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10-04-2024 09:21
General
-
Target
0335de8eadbbd5dc7cbe92ef869bcea6f6596ac39a38680142c982ec6e97ecde.xlam
-
Size
127KB
-
MD5
e0f6bcdb71df502f7aefe22db8207a69
-
SHA1
9f7357219cbfb5b940d5809f8564a6bb821fa036
-
SHA256
0335de8eadbbd5dc7cbe92ef869bcea6f6596ac39a38680142c982ec6e97ecde
-
SHA512
ea9fc5fe2bcd8a225c7f7f7b8ea832e3d143278a07c6264edaf9476fb5e7852efdd9b3dbcde6e211ccb1e6d011b11845def65af58e9298a01b3067a05200d7cc
-
SSDEEP
3072:NDKcDiVBG5Q0fULY/fPiY4XXnfWFsnNfWSWe:NDDD0BGCY/fkXvTNf5
Malware Config
Signatures
-
CrimsonRAT main payload 1 IoCs
-
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 24 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0335de8eadbbd5dc7cbe92ef869bcea6f6596ac39a38680142c982ec6e97ecde.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Glhvadia\hbraeiwas.exeC:\Users\Admin\Glhvadia\hbraeiwas.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Hdlharas\dlrarhsiva.exe"C:\ProgramData\Hdlharas\dlrarhsiva.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.1MB
MD5b35ab8d47748801afa154144c2891dc4
SHA1c2c356c1a6abd7858d9a143da35c7fadff9f8edb
SHA25615c45d634c70f0604cfe30806320090c66a65d8f8a26303db3c9c15bf3cc950c
SHA512a89686b0e7bb0b7ab6281a69448cc050ce3fe6a5c56ec9f5f2869106b3e2560a84554463bb9bb277d7f6da5a90a9f07f8ab5369f793fbb21dab56d868ae1ed45
-
Filesize
56KB
MD5f0992d9b27d773b120109a5d1adec3d0
SHA19b1764b9e7b24fd8f4763fd33376ad9278b0bf04
SHA2563a50f9963f2f20618c907bfe5134cf11a727d2a4808875b6cba9ecb5ce635c04
SHA512e5368ebe377ebce87d6aa242898ae8fc9f94db0987c6bca1f669375a418e11f5d99b5f406c91e82ef0cf42bc56efbced77a58b1921b8eecf49cb4ea3d348c235
-
Filesize
83KB
MD54663018621abd6313f9edb03c0737517
SHA1a9dd4c0303b261344d469362bd80c4e366e79692
SHA256e2200fa8b8c4757039e3f78536d9442817331f530e4348e08f02af753e7ae024
SHA51264d44f463b2d855c17b495ec056998b6f522f5078743621322f1cb574acf2ead445b0fe0f853a420941dfae2c09f5965ea383e48af74479d9c6c5a14c44a8f55
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
664KB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
304KB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
64KB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB