Analysis
-
max time kernel
59s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 21:01
General
-
Target
f1b61e942e02bf9d3ba3373d34fb69a925fa4bbb25dda27286996dc71979423d.xls
-
Size
625KB
-
MD5
efd3d1d5e1b815fd868f68d112b3394f
-
SHA1
1e354b9180d20b2a3c3632caa3bec5ffbb8b7dfe
-
SHA256
f1b61e942e02bf9d3ba3373d34fb69a925fa4bbb25dda27286996dc71979423d
-
SHA512
362fa00ffea6d3f604bf465a9c05046ea53c8c25a03018d2b7fc00fdbd646f98d230e9516c04b6a1b5362a4e7bb64edd3fa4c0516f0ae81704d38892c35bbef7
-
SSDEEP
6144:QZ+RwPONXoRjDhIcp0fDlavx+W26nA5knQ:4n
Malware Config
Extracted
crimsonrat
79.143.181.178
Signatures
-
CrimsonRAT main payload 1 IoCs
-
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Crimsonrat family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f1b61e942e02bf9d3ba3373d34fb69a925fa4bbb25dda27286996dc71979423d.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MFjWSZ.exeC:\Users\Admin\AppData\Roaming\MFjWSZ.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
MD5939c65b870c71b3a865b5bdd0476eb84
SHA14163c99b888a378be1d2c6fa45d20ce042d00252
SHA256842699b57bef204fbe629835c0e6b3bbfd3093755ff9fe558bb6295f87d7cadb
SHA512be86ed892c5cf4bf670708f018fc3d49cff1d84f6b7d2a31d9351b3e440e2d5de4dda8a1991efc2b07ac41cc2fb145e4c94c7c27bb98fbfa9d823d558e6b6d6c
-
Filesize
1KB
MD57792157ebf4680b9d2616cc2eae631a2
SHA1873069c8fd2556d1772771d4d3ed9ed8a3070412
SHA256e5b2bf913bfa0a23db6577afb2c2479b26bb5310b51db3fcf65fba23186f4568
SHA51277757253639ca7060e5dfd70253d694d55fc998a7d2c5f56151aaab54468219ab9441a4b4dc1c8251279445e33a45ab256a9dd5d80f3bbd0cae7a596879296d4
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB