Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-04-2024 14:28

General

  • Target

    dbb9168502e819619e94d9dc211d5f4967d8083ac5f4f67742b926abb04e6676.doc

  • Size

    790KB

  • MD5

    c7a3276763a5c1b13f93028aab5a6e73

  • SHA1

    c2844b69a36b3be37f8db97b0afc051f6bf36671

  • SHA256

    dbb9168502e819619e94d9dc211d5f4967d8083ac5f4f67742b926abb04e6676

  • SHA512

    2ef8d3eb3f1368591666d9f85dddb210c05fe16569f3553086f42d7b82133669c5a9e7fe1263407bb54bb9f75216ef9fcb78348427e334ef74afd6e3f429c01a

  • SSDEEP

    3072:PkWc08tG41FHiopEomJ9/GuloC5pUAn0YoKpbqZSvYYzU6lXHaym97m/EE3fzLvd:PkA

Score
10/10

Malware Config

Extracted

Family

crimsonrat

C2

151.106.14.125

211.210.122.154

Signatures

  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

  • Executes dropped EXE 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\dbb9168502e819619e94d9dc211d5f4967d8083ac5f4f67742b926abb04e6676.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2052
    • C:\ProgramData\Dlymrdsa\ravidhtirad.exe
      C:\ProgramData\Dlymrdsa\ravidhtirad.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Dlymrdsa\ravidhtirad.exe

    Filesize

    9.2MB

    MD5

    62519adeb63e478fe8975c020deeec95

    SHA1

    e15ecda470e6fa76beb1833458c46511d35c36e7

    SHA256

    8f01ae46434e75207d29bc6de069b67c350120a9880cc8e30fefc19471eaac4a

    SHA512

    527575ea610facde3dccdaf7479b4c3a220b1ebd8a361555015f4ab9ecaa7947b61f810f3474839e7ee8f9d2ff5d9b14898ae4a9f3489aa95e6f7639da318d80

  • C:\ProgramData\Dlymrdsa\ravidhtirad.zip

    Filesize

    100KB

    MD5

    b1c94f3ca426b21338a03e612aec74d8

    SHA1

    fa378065fc60c2c8fa82e33acee7902991a28808

    SHA256

    23ad57f9cd87f9cfa99a3c429a55498ade18f099b1e8af21e4efd868bbbfb880

    SHA512

    2ba21f58d6226124c6ed9184a6c686559eb59390bd67bb81d280eb62c9cd4351ef7e3305d08ec60e3664621687661b5be7f3ce5df9e26fd692e82e6a6bffacff

  • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • memory/740-111-0x0000021FF9450000-0x0000021FF9460000-memory.dmp

    Filesize

    64KB

  • memory/740-110-0x00007FFB3FA00000-0x00007FFB404C1000-memory.dmp

    Filesize

    10.8MB

  • memory/740-81-0x0000021FF9450000-0x0000021FF9460000-memory.dmp

    Filesize

    64KB

  • memory/740-80-0x0000021FF6410000-0x0000021FF6D40000-memory.dmp

    Filesize

    9.2MB

  • memory/740-79-0x00007FFB3FA00000-0x00007FFB404C1000-memory.dmp

    Filesize

    10.8MB

  • memory/2052-19-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-61-0x000002CA993A0000-0x000002CA9A370000-memory.dmp

    Filesize

    15.8MB

  • memory/2052-10-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB

  • memory/2052-11-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-12-0x00007FFB2B3B0000-0x00007FFB2B3C0000-memory.dmp

    Filesize

    64KB

  • memory/2052-13-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-14-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-15-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-17-0x00007FFB2B3B0000-0x00007FFB2B3C0000-memory.dmp

    Filesize

    64KB

  • memory/2052-18-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-16-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-20-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-21-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-22-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-1-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-31-0x000002CA993A0000-0x000002CA9A370000-memory.dmp

    Filesize

    15.8MB

  • memory/2052-32-0x000002CA9FF10000-0x000002CAA0110000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-52-0x000002CA993A0000-0x000002CA9A370000-memory.dmp

    Filesize

    15.8MB

  • memory/2052-8-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-9-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-7-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB

  • memory/2052-6-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-4-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-5-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB

  • memory/2052-89-0x000002CA97F90000-0x000002CA98790000-memory.dmp

    Filesize

    8.0MB

  • memory/2052-90-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-91-0x000002CA97F90000-0x000002CA98790000-memory.dmp

    Filesize

    8.0MB

  • memory/2052-3-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB

  • memory/2052-101-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-105-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-106-0x000002CA993A0000-0x000002CA9A370000-memory.dmp

    Filesize

    15.8MB

  • memory/2052-107-0x000002CA9FF10000-0x000002CAA0110000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-108-0x000002CA993A0000-0x000002CA9A370000-memory.dmp

    Filesize

    15.8MB

  • memory/2052-109-0x000002CA993A0000-0x000002CA9A370000-memory.dmp

    Filesize

    15.8MB

  • memory/2052-2-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-0-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB

  • memory/2052-112-0x000002CA97F90000-0x000002CA98790000-memory.dmp

    Filesize

    8.0MB

  • memory/2052-113-0x000002CA97F90000-0x000002CA98790000-memory.dmp

    Filesize

    8.0MB