Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2024 21:51
Behavioral task
behavioral1
Sample
2628ad9be62db33bcc2dd982d80a7ec4ff840349a658795e13ef9611b784eefe.xls
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2628ad9be62db33bcc2dd982d80a7ec4ff840349a658795e13ef9611b784eefe.xls
Resource
win10v2004-20241007-en
General
-
Target
2628ad9be62db33bcc2dd982d80a7ec4ff840349a658795e13ef9611b784eefe.xls
-
Size
423KB
-
MD5
fa6a95df0af45ff6601696678af711b6
-
SHA1
c87653f543d7c9386b92732e02ee64deac0e0100
-
SHA256
2628ad9be62db33bcc2dd982d80a7ec4ff840349a658795e13ef9611b784eefe
-
SHA512
362d3bd45dcf7b419661a4a77545d337d7f294a143f732e18dd7f728f04e99772bb45e205513c4c03f6975778ba2d812cc6e288ff5e6591ca04ad2a639d3fc02
-
SSDEEP
6144:ixEtjPOtioVjDGUU1qfDlavx+W2QnASFR:TF
Malware Config
Signatures
-
CrimsonRAT main payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b7a-70.dat family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Crimsonrat family
-
Executes dropped EXE 1 IoCs
pid Process 400 rlbwrarhsa.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4812 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4812 wrote to memory of 400 4812 EXCEL.EXE 87 PID 4812 wrote to memory of 400 4812 EXCEL.EXE 87
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2628ad9be62db33bcc2dd982d80a7ec4ff840349a658795e13ef9611b784eefe.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\ProgramData\Tdlawis\rlbwrarhsa.exeC:\ProgramData\Tdlawis\rlbwrarhsa.exe2⤵
- Executes dropped EXE
PID:400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5aac869f05f219ae6508ad279a97120d1
SHA11de68ade3b8f45a2b7b846b35768e6301b5e2e0d
SHA2560b655acf2e3c1c72746c4a69f56f4c5149b27cfea9d10fe2dbffd411b8b4fd8d
SHA51251199423ed586ae4a2990df54a0231d9ea0d067e0f9badb3139b9a3a61f2d8044a02e1f8d27fcc4d7f59118d84326a1cc74f68c76e95b71a8ce7c1953451c05f
-
Filesize
9.6MB
MD58a1f4a512fe9edbcc62ba4b1c3e08f0a
SHA1fcc99860e1029e0d989121be46eb1da2f8402853
SHA256ecd7d7a27a2a043919a233bb91e3b009c05b7c81ff132a7c29228e1c45d2b6a6
SHA5120e78fa869f051b5672b6f7a4dcc02ae7cdca55ba8ac2b14a34f30e94844fddb7caa22ac9fd555ac0bb270c1bfbedcb3e7ef074fcf9cba8dbf2ba0d5dc690444c