Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/04/2024, 14:28
General
- Target dbb9168502e819619e94d9dc211d5f4967d8083ac5f4f67742b926abb04e6676.doc
- Size 790KB
- Sample240410-rtcyysec2w
- SHA256 dbb9168502e819619e94d9dc211d5f4967d8083ac5f4f67742b926abb04e6676
Malware Config
Extracted
-
crimsonrat
-
151.106.14.125
-
211.210.122.154
Signatures
- CrimsonRAT main payload 1 IoCs
- CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
- Executes dropped EXE 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\dbb9168502e819619e94d9dc211d5f4967d8083ac5f4f67742b926abb04e6676.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Dlymrdsa\ravidhtirad.exeC:\ProgramData\Dlymrdsa\ravidhtirad.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ravidhtirad.exe
ravidhtirad.zip
ExcludeDictionaryEN0409.lex
memory/740-111-0x0000021FF9450000-0x0000021FF9460000-memory.dmp
memory/740-110-0x00007FFB3FA00000-0x00007FFB404C1000-memory.dmp
memory/740-81-0x0000021FF9450000-0x0000021FF9460000-memory.dmp
memory/740-80-0x0000021FF6410000-0x0000021FF6D40000-memory.dmp
memory/740-79-0x00007FFB3FA00000-0x00007FFB404C1000-memory.dmp
memory/2052-19-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-61-0x000002CA993A0000-0x000002CA9A370000-memory.dmp
memory/2052-10-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp
memory/2052-11-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-12-0x00007FFB2B3B0000-0x00007FFB2B3C0000-memory.dmp
memory/2052-13-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-14-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-15-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-17-0x00007FFB2B3B0000-0x00007FFB2B3C0000-memory.dmp
memory/2052-18-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-16-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-20-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-21-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-22-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-1-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-31-0x000002CA993A0000-0x000002CA9A370000-memory.dmp
memory/2052-32-0x000002CA9FF10000-0x000002CAA0110000-memory.dmp
memory/2052-52-0x000002CA993A0000-0x000002CA9A370000-memory.dmp
memory/2052-8-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-9-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-7-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp
memory/2052-6-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-4-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-5-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp
memory/2052-89-0x000002CA97F90000-0x000002CA98790000-memory.dmp
memory/2052-90-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-91-0x000002CA97F90000-0x000002CA98790000-memory.dmp
memory/2052-3-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp
memory/2052-101-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-105-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-106-0x000002CA993A0000-0x000002CA9A370000-memory.dmp
memory/2052-107-0x000002CA9FF10000-0x000002CAA0110000-memory.dmp
memory/2052-108-0x000002CA993A0000-0x000002CA9A370000-memory.dmp
memory/2052-109-0x000002CA993A0000-0x000002CA9A370000-memory.dmp
memory/2052-2-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp
memory/2052-0-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp
memory/2052-112-0x000002CA97F90000-0x000002CA98790000-memory.dmp
memory/2052-113-0x000002CA97F90000-0x000002CA98790000-memory.dmp