General
-
Target
RNSM00399.7z
-
Size
33.1MB
-
Sample
241031-ze99xatdpl
-
MD5
846e189b61eff1e4b2107586b721d0a9
-
SHA1
a17ad7404737bdf6b162ed7e2c035161da6bfb4f
-
SHA256
458caa60b5fbf91bdaf60eea708fa2e5660772180b721a153e2bf6b3f6c5b88f
-
SHA512
5cb49458c8918572e861cc602fd6adc1c49b0658dfbb8ed33773216f4ccc8b3139c8d800d7e97e9ebc77e1339ea4a4d6553d2d16e30367018b0936e67d64431e
-
SSDEEP
786432:bxDypf4kaZp1bwM3bcywK7tgIpWzTjdspli3YyZEz1PIYU:YpIp5zwK7tgIpWzviz1g5
Static task
static1
Behavioral task
behavioral1
Sample
RNSM00399.7z
Resource
win10v2004-20241007-en
Malware Config
Extracted
crimsonrat
64.188.12.126
Extracted
C:\Users\Public\Documents\!!!_READ_ME_C193238C_!!!.txt
https://prnt.sc/vb3g0f
https://prnt.sc/vb3hg9
https://prnt.sc/vb3hqd
https://prnt.sc/vb3iuj
https://prnt.sc/vb3j7c
https://prnt.sc/vb3m3t
https://prnt.sc/vb3pia
http://p6o7m73ujalhgkiv.onion/?068vV05uS2GCgqa
http://rgnar43spcnsocswaw22lmk7jnget5f6vow7kqmnf4jc6hfwpiwoajid.onion/client/?FB5dDAEC6F63aA6cd5D52B8822e2Eb0278aDCCEE8E7592f379ed00Ac14fD16cc
Targets
-
-
Target
RNSM00399.7z
-
Size
33.1MB
-
MD5
846e189b61eff1e4b2107586b721d0a9
-
SHA1
a17ad7404737bdf6b162ed7e2c035161da6bfb4f
-
SHA256
458caa60b5fbf91bdaf60eea708fa2e5660772180b721a153e2bf6b3f6c5b88f
-
SHA512
5cb49458c8918572e861cc602fd6adc1c49b0658dfbb8ed33773216f4ccc8b3139c8d800d7e97e9ebc77e1339ea4a4d6553d2d16e30367018b0936e67d64431e
-
SSDEEP
786432:bxDypf4kaZp1bwM3bcywK7tgIpWzTjdspli3YyZEz1PIYU:YpIp5zwK7tgIpWzviz1g5
-
CrimsonRAT main payload
-
Crimsonrat family
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Dharma family
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (523) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
2File Deletion
2Modify Registry
1Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
3Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1