Extracted

• • Target

    crashpad_handler.exe

  • Size

    615KB

  • MD5

    9f12b93fbe757f35df3cb953a52c593f

  • SHA1

    74e3808a94a78ccecdee9cb8b02eb0ee23ac9a81

  • SHA256

    d7fdaa84062bd7594fc5fc9a9eef37afe07f25a6c2e332e88bac1b35becb4c81

  • SHA512

    798b46eb29f0d3f849ee1c57ed16ebd0d4fa63f9ba10edefa8a26683b5baf43afe2213f46e5da4ce391af56fb3310c89e938f48738168c48dd0718494eaef203

  • SSDEEP

    12288:PWHL42mwBOrsD7AVFO5rxLEuuOdfj/Tua/rRe408RIE:OUzwBUsD7AVFO5rxLEuuOdfj/Tua/9ep

  Score

  10^/10

  chimeracrimsonratnjratdefense_evasiondiscoveryevasionpersistenceprivilege_escalationransomwareratspywarestealertrojan

  • Chimera

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera

  • Chimera Ransomware Loader DLL

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Renames multiple (3280) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  behavioral1