Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
31-08-2024 03:17
Static task
static1
Behavioral task
behavioral1
Sample
$ROWJ11R.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
$ROWJ11R.exe
Resource
win10v2004-20240802-en
General
-
Target
$ROWJ11R.exe
-
Size
84KB
-
MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c
-
SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60
-
SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba
-
SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741
-
SSDEEP
1536:IjoAILD000jsdtP66K3uch3bCuExwwSV712fRp1Oo2IeG:IqLD000wD6VRhLbzwSv2H1beG
Malware Config
Extracted
crimsonrat
185.136.161.124
Signatures
-
CrimsonRAT main payload 1 IoCs
resource yara_rule behavioral1/files/0x0006000000018b89-24.dat family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
pid Process 2812 dlrarhsiva.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Hdlharas\dlrarhsiva.exe $ROWJ11R.exe File opened for modification C:\PROGRA~3\Hdlharas\dlrarhsiva.exe $ROWJ11R.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2812 2064 $ROWJ11R.exe 29 PID 2064 wrote to memory of 2812 2064 $ROWJ11R.exe 29 PID 2064 wrote to memory of 2812 2064 $ROWJ11R.exe 29 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\$ROWJ11R.exe"C:\Users\Admin\AppData\Local\Temp\$ROWJ11R.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\ProgramData\Hdlharas\dlrarhsiva.exe"C:\ProgramData\Hdlharas\dlrarhsiva.exe"2⤵
- Executes dropped EXE
PID:2812
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5b635f6f767e485c7e17833411d567712
SHA15a9cbdca7794aae308c44edfa7a1ff5b155e4aa8
SHA2566838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e
SHA512551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af
-
Filesize
9.1MB
MD564261d5f3b07671f15b7f10f2f78da3f
SHA1d4f978177394024bb4d0e5b6b972a5f72f830181
SHA25687f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad
SHA5123a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a