crimsonrat | f1b61e942e02bf9d3ba3373d34fb69a925fa4bbb25dda27286996dc71979423d

General

Target

f1b61e942e02bf9d3ba3373d34fb69a925fa4bbb25dda27286996dc71979423d.xls
Size

625KB
MD5

efd3d1d5e1b815fd868f68d112b3394f
SHA1

1e354b9180d20b2a3c3632caa3bec5ffbb8b7dfe
SHA256

f1b61e942e02bf9d3ba3373d34fb69a925fa4bbb25dda27286996dc71979423d
SHA512

362fa00ffea6d3f604bf465a9c05046ea53c8c25a03018d2b7fc00fdbd646f98d230e9516c04b6a1b5362a4e7bb64edd3fa4c0516f0ae81704d38892c35bbef7
SSDEEP

6144:QZ+RwPONXoRjDhIcp0fDlavx+W26nA5knQ:4n

Score

10^/10

crimsonrat discovery persistence rat

Malware Config

Extracted

Family

crimsonrat

C2

79.143.181.178

Signatures

CrimsonRAT main payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00020000000229a3-58.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Crimsonrat family
crimsonrat

Executes dropped EXE 1 IoCs

pid	Process
3752	oZh0Ig.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wsecor = "C:\\ProgramData\\Mins\\mieces.exe"	oZh0Ig.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oZh0Ig.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
552	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3752	oZh0Ig.exe
3752	oZh0Ig.exe
3752	oZh0Ig.exe
3752	oZh0Ig.exe
3752	oZh0Ig.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3752	oZh0Ig.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 3752	552	EXCEL.EXE	88
PID 552 wrote to memory of 3752	552	EXCEL.EXE	88
PID 552 wrote to memory of 3752	552	EXCEL.EXE	88

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f1b61e942e02bf9d3ba3373d34fb69a925fa4bbb25dda27286996dc71979423d.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Roaming\oZh0Ig.exe
  C:\Users\Admin\AppData\Roaming\oZh0Ig.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
43c60f2fd83fb333bfc67427196eab16

SHA1
611091196170d0ed9ec0ce066225cd4d7aead3f4

SHA256
c8b885a09e1863aa69017425776e019dfe0495d556c5651c35a8dafc04a3e4b6

SHA512
9e6a415eca55b5184ace4a0311a97ad4459e577597bd3262861aa3dc00c7b8363b745b73613263da50e6ea573b7081c381b7f43edce4841b1508d29f3e2b3998

Download Submit
C:\Users\Admin\AppData\Roaming\oZh0Ig.exe

Filesize
188KB

MD5
939c65b870c71b3a865b5bdd0476eb84

SHA1
4163c99b888a378be1d2c6fa45d20ce042d00252

SHA256
842699b57bef204fbe629835c0e6b3bbfd3093755ff9fe558bb6295f87d7cadb

SHA512
be86ed892c5cf4bf670708f018fc3d49cff1d84f6b7d2a31d9351b3e440e2d5de4dda8a1991efc2b07ac41cc2fb145e4c94c7c27bb98fbfa9d823d558e6b6d6c

Download Submit
memory/552-16-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-13-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-3-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

Filesize
64KB

Download
memory/552-22-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-6-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-7-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-9-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-23-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-12-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-14-0x00007FFCB4910000-0x00007FFCB4920000-memory.dmp

Filesize
64KB

Download
memory/552-11-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-15-0x00007FFCB4910000-0x00007FFCB4920000-memory.dmp

Filesize
64KB

Download
memory/552-10-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-40-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-1-0x00007FFCF728D000-0x00007FFCF728E000-memory.dmp

Filesize
4KB

Download
memory/552-8-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

Filesize
64KB

Download
memory/552-5-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-0-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

Filesize
64KB

Download
memory/552-17-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-52-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-53-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-4-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

Filesize
64KB

Download
memory/552-56-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-61-0x00007FFCF728D000-0x00007FFCF728E000-memory.dmp

Filesize
4KB

Download
memory/552-62-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-2-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

Filesize
64KB

Download
memory/552-72-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-65-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-66-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-67-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/552-68-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/3752-64-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download
memory/3752-60-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads