General
-
Target
RNSM00411.7z
-
Size
32.5MB
-
Sample
241028-vkktzssjcn
-
MD5
96bfb62905f39619b7b785f8099c90c7
-
SHA1
31259c5c39795fea53fa028c77f4cf4bf15a729b
-
SHA256
ced8995052eb04eaa76fabfe606a380258bf803cc4b93202f135055663e3001d
-
SHA512
7a6a32de9b60531472ab5cc485de10a783fe3ff8fb636e0aa5a02bc16d58e62121ccfcfbb82fc995153151a77480dc6cf8a0972358a2ed1fd02cbe391de89805
-
SSDEEP
393216:/b8jdwLefLCFCsbafJ/PCYRcei2yDNyJtUMNouhGwhU4AJ1r0J+mhoEhN:T+bLGCsbgzfOJMeuhaJQh7hN
Static task
static1
Behavioral task
behavioral1
Sample
RNSM00411.7z
Resource
win10v2004-20241007-en
Malware Config
Extracted
crimsonrat
172.245.87.12
Targets
-
-
Target
RNSM00411.7z
-
Size
32.5MB
-
MD5
96bfb62905f39619b7b785f8099c90c7
-
SHA1
31259c5c39795fea53fa028c77f4cf4bf15a729b
-
SHA256
ced8995052eb04eaa76fabfe606a380258bf803cc4b93202f135055663e3001d
-
SHA512
7a6a32de9b60531472ab5cc485de10a783fe3ff8fb636e0aa5a02bc16d58e62121ccfcfbb82fc995153151a77480dc6cf8a0972358a2ed1fd02cbe391de89805
-
SSDEEP
393216:/b8jdwLefLCFCsbafJ/PCYRcei2yDNyJtUMNouhGwhU4AJ1r0J+mhoEhN:T+bLGCsbgzfOJMeuhaJQh7hN
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
CrimsonRAT main payload
-
Crimsonrat family
-
GandCrab payload
-
Gandcrab family
-
Modifies WinLogon for persistence
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Renames multiple (55) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Executes dropped EXE
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
4Modify Registry
9Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1