Analysis
-
max time kernel
40s -
max time network
24s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-04-2024 18:19
Behavioral task
behavioral1
Sample
dlrarhsiva.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
dlrarhsiva.exe
-
Size
9.1MB
-
MD5
64261d5f3b07671f15b7f10f2f78da3f
-
SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181
-
SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad
-
SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a
-
SSDEEP
768:nK6i7INFzKMNDOrt1Ln84KcN5jv7tLoQOoAdIERGo:K6C6PDEtN84PjSQOo2IeG
Score
10/10
Malware Config
Extracted
Family
crimsonrat
C2
185.136.161.124
Signatures
-
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2884 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2884 taskmgr.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe -
Suspicious use of SendNotifyMessage 36 IoCs
pid Process 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dlrarhsiva.exe"C:\Users\Admin\AppData\Local\Temp\dlrarhsiva.exe"1⤵PID:1816
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2884