Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    70s
  • max time network
    75s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/10/2024, 20:49

General

  • Target

    CrimsonRAT.exe

  • Size

    84KB

  • MD5

    b6e148ee1a2a3b460dd2a0adbf1dd39c

  • SHA1

    ec0efbe8fd2fa5300164e9e4eded0d40da549c60

  • SHA256

    dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

  • SHA512

    4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

  • SSDEEP

    1536:IjoAILD000jsdtP66K3uch3bCuExwwSV712fRp1Oo2IeG:IqLD000wD6VRhLbzwSv2H1beG

Score
10/10

Malware Config

Extracted

Family

crimsonrat

C2

185.136.161.124

Signatures

  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\CrimsonRAT.exe
    "C:\Users\Admin\AppData\Local\Temp\CrimsonRAT.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\ProgramData\Hdlharas\dlrarhsiva.exe
      "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
      2⤵
      • Executes dropped EXE
      PID:2740
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2820

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\PROGRA~3\Hdlharas\mdkhm.zip

      Filesize

      56KB

      MD5

      b635f6f767e485c7e17833411d567712

      SHA1

      5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

      SHA256

      6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

      SHA512

      551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

    • C:\ProgramData\Hdlharas\dlrarhsiva.exe

      Filesize

      9.1MB

      MD5

      64261d5f3b07671f15b7f10f2f78da3f

      SHA1

      d4f978177394024bb4d0e5b6b972a5f72f830181

      SHA256

      87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

      SHA512

      3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

    • memory/1916-0-0x000007FEF5813000-0x000007FEF5814000-memory.dmp

      Filesize

      4KB

    • memory/1916-1-0x0000000000140000-0x000000000015E000-memory.dmp

      Filesize

      120KB

    • memory/1916-2-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

      Filesize

      9.9MB

    • memory/1916-30-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2740-28-0x0000000000140000-0x0000000000A54000-memory.dmp

      Filesize

      9.1MB

    • memory/2740-27-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2740-29-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

      Filesize

      9.9MB

    • memory/2740-31-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

      Filesize

      9.9MB