Analysis
-
max time kernel
183s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10-04-2024 09:32
General
-
Target
0d61d5fe8dbf69c6e61771451212fc8e587d93246bd866adf1031147d6d4f8c2.ppam
-
Size
396KB
-
MD5
70635541c80cd5a237ff789abcce4e27
-
SHA1
69639bccfdfc319d64ab89d5ee03d29f6f6133a7
-
SHA256
0d61d5fe8dbf69c6e61771451212fc8e587d93246bd866adf1031147d6d4f8c2
-
SHA512
8470f9581032dca01aacd5ca55974d56bc34d652fc1b2f25883002d5c28330b2ce04fe69031d72e3b3d4e2fd058c32263af538d64f3e23757ff350d70d6f7867
-
SSDEEP
6144:ilRaWUni3pcJi9U+K/mpL0IfyzvfJ1vC53oPWVkuKsxkx:OUWOUXq+emC3Trq9Elskx
Malware Config
Extracted
crimsonrat
192.3.99.68
Signatures
-
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\0d61d5fe8dbf69c6e61771451212fc8e587d93246bd866adf1031147d6d4f8c2.ppam" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Offiecs3414\ppt\embeddings\hiartbnaiw.exeC:\ProgramData\Offiecs3414\ppt\embeddings\hiartbnaiw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
396KB
MD570635541c80cd5a237ff789abcce4e27
SHA169639bccfdfc319d64ab89d5ee03d29f6f6133a7
SHA2560d61d5fe8dbf69c6e61771451212fc8e587d93246bd866adf1031147d6d4f8c2
SHA5128470f9581032dca01aacd5ca55974d56bc34d652fc1b2f25883002d5c28330b2ce04fe69031d72e3b3d4e2fd058c32263af538d64f3e23757ff350d70d6f7867
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
10.5MB
MD5ac4944bec64b6d40f3bb16d6ed3f06e8
SHA1ad07a2a5d0da4e0aeeb997a9c07a8729ab3a3de7
SHA256fc34f9087ab199d0bac22aa97de48e5592dbf0784342b9ecd01b4a429272ab5b
SHA5124185bbaa8ebca5da475d4b99d4fc9871c8ce57a1d9e69952fc5171adf979af320775f51b6875e43a62925a1c8a1e1b5f8da3bfc49d63aa6be2b3394eb1aa0f0e
-
Filesize
337B
MD524ceeb9ff9e1adc52605df7a4922ab2e
SHA15541f246782d0e9073f68cd1ef4efa709bdc4a72
SHA2569184915b2154e3cdf1d2099ab5ae229a076912bb72f0fae07d9db1ece6ed292f
SHA5126c56543083f210e87f9f0f12fe537cb9d14d6c4a3474f65bbeb71305824b95acc8e7d1727e58a879e1b7c3de379c841f38eb75890c371407b7ff93416c40b223
-
Filesize
175KB
MD5643218061bd19bc22c91eb67e688d0ad
SHA10bdba98f3f080a9e367dbd44e8051768ccc7a331
SHA2568f905ae9b5f3c9d1f4a2a3ba5c366fb2213629c077b43d85eb6fd005b4c47bfb
SHA512a45c29077622ee9b2ee72128707a4d4370a93a1f8f96511defa36ee563d37e198fcd3047282a77acefe2cda2c57ee460c63f9fe9164f3c5a5de589dcbed5366a
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.5MB
-
Filesize
10.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
8.0MB
-
Filesize
64KB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
8.0MB
-
Filesize
64KB
-
Filesize
2.0MB