Overview

overview

10

Static

static

1

SteamRIP -...].html

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-08-2024 09:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SteamRIP - 🧠-palace-of-humility [1256286199694495844].html

  • Size

    238KB

  • MD5

    17ff4593972658c0964b6813e1aab14d

  • SHA1

    4d2257ff540dd6e1ab14fce6a4aa1be96721ce3b

  • SHA256

    26ecb3cd51fbaab64cfc024eabe3c0c8230001594be9b34b9e943d01fe02ea79

  • SHA512

    64367f97c622f38a74ead0b7596dfef0c282c28e35e70bb5affec99d28f9358b96eaf7af9f4fd7b85af28b9ce7887e58f8bcc83abc76946a88dba94d77d6ae63

  • SSDEEP

    1536:4MNDL8DMDahDEqlDO/RnXbvYEVoSWaoo1TREiDQcD0sFbyMzQrHPDfaS3epmxZCr:NeCuTsX8XDzsl+SRP

Score
10/10
crimsonratdiscoveryratupx

Malware Config

Extracted

Family

crimsonrat

C2

185.136.161.124

Signatures

  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\SteamRIP - 🧠-palace-of-humility [1256286199694495844].html
    1⤵
      PID:4812
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4372,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
      1⤵
        PID:2808
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3888,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
        1⤵
          PID:756
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5444,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
          1⤵
            PID:4964
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5440,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
            1⤵
              PID:4824
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --field-trial-handle=5904,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
              1⤵
                PID:3876
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5312,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
                1⤵
                  PID:1064
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6300,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
                  1⤵
                    PID:376
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=6360,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
                    1⤵
                      PID:632
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6312,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
                      1⤵
                        PID:2580
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=5920,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
                        1⤵
                          PID:4072
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=5352,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
                          1⤵
                            PID:2808
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=5200,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
                            1⤵
                              PID:3352
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --field-trial-handle=6676,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
                              1⤵
                                PID:4848
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6888,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
                                1⤵
                                  PID:3208
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=6892,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
                                  1⤵
                                    PID:2400
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7252,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:8
                                    1⤵
                                      PID:2840
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --field-trial-handle=7264,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:8
                                      1⤵
                                        PID:4536
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=7260,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:8
                                        1⤵
                                          PID:3620
                                        • C:\Users\Admin\Downloads\BlueScreen.exe
                                          "C:\Users\Admin\Downloads\BlueScreen.exe"
                                          1⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2780
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=6156,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:1
                                          1⤵
                                            PID:5236
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6524,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:8
                                            1⤵
                                              PID:5456
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\DudleyTrojan.bat" "
                                              1⤵
                                                PID:5520
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\DudleyTrojan.bat" "
                                                1⤵
                                                  PID:5652
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --field-trial-handle=7728,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:1
                                                  1⤵
                                                    PID:5820
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7284,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:8
                                                    1⤵
                                                      PID:4444
                                                    • C:\Users\Admin\Downloads\FlashKiller.exe
                                                      "C:\Users\Admin\Downloads\FlashKiller.exe"
                                                      1⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5536
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 240
                                                        2⤵
                                                        • Program crash
                                                        PID:4452
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5536 -ip 5536
                                                      1⤵
                                                        PID:2228
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --field-trial-handle=5616,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
                                                        1⤵
                                                          PID:5716
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=5712,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
                                                          1⤵
                                                            PID:4876
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --field-trial-handle=4392,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
                                                            1⤵
                                                              PID:372
                                                            • C:\Users\Admin\Downloads\CrimsonRAT.exe
                                                              "C:\Users\Admin\Downloads\CrimsonRAT.exe"
                                                              1⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:452
                                                              • C:\ProgramData\Hdlharas\dlrarhsiva.exe
                                                                "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:4540
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --field-trial-handle=6660,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
                                                              1⤵
                                                                PID:6120

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\ProgramData\Hdlharas\dlrarhsiva.exe
                                                                Filesize

                                                                9.1MB

                                                                MD5

                                                                64261d5f3b07671f15b7f10f2f78da3f

                                                                SHA1

                                                                d4f978177394024bb4d0e5b6b972a5f72f830181

                                                                SHA256

                                                                87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

                                                                SHA512

                                                                3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

                                                                Download Submit

                                                              • C:\ProgramData\Hdlharas\mdkhm.zip
                                                                Filesize

                                                                56KB

                                                                MD5

                                                                b635f6f767e485c7e17833411d567712

                                                                SHA1

                                                                5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

                                                                SHA256

                                                                6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

                                                                SHA512

                                                                551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

                                                                Download Submit

                                                              • C:\Users\Admin\Downloads\AUTOEXEC.BAT
                                                                Filesize

                                                                126B

                                                                MD5

                                                                027123c3a82c7d185bb574998582229f

                                                                SHA1

                                                                05596834cbaf4d6abb203497f2385d4e567b25d4

                                                                SHA256

                                                                7d5fda92b3738c74bcbfe85b299993447834ea6616405491a4d75050f6170809

                                                                SHA512

                                                                338f017573f1e98b80f2d02a008274aaa73e68382fdcd389f2e44d3b01965ea56139c8add01283d26e04f56065d3fed58e0ed4a91ecf6f51ba4f18386529eeaa

                                                                Download Submit

                                                              • memory/452-14-0x00007FFA230F3000-0x00007FFA230F5000-memory.dmp

                                                                Filesize

                                                                8KB

                                                                Download

                                                              • memory/452-15-0x000001B3B5590000-0x000001B3B55AE000-memory.dmp

                                                                Filesize

                                                                120KB

                                                                Download

                                                              • memory/452-16-0x00007FFA230F0000-0x00007FFA23BB1000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                                Download

                                                              • memory/452-50-0x00007FFA230F0000-0x00007FFA23BB1000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                                Download

                                                              • memory/2780-0-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                Filesize

                                                                36KB

                                                                Download

                                                              • memory/2780-1-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                Filesize

                                                                36KB

                                                                Download

                                                              • memory/4540-49-0x0000027BD54B0000-0x0000027BD5DC4000-memory.dmp

                                                                Filesize

                                                                9.1MB

                                                                Download

                                                              • memory/5536-13-0x0000000000400000-0x0000000000404000-memory.dmp

                                                                Filesize

                                                                16KB

                                                                Download