Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/02/2025, 04:13

General

  • Target

    b5c8e2afa1091e9513da06cfaa1ceed25e091692cdfe7f304e367c58957e2d63.exe

  • Size

    15.8MB

  • MD5

    3a231bcc60569143aa899295e4a5ce8a

  • SHA1

    8916cceb3f1b309d866bea10da41465baf720b00

  • SHA256

    b5c8e2afa1091e9513da06cfaa1ceed25e091692cdfe7f304e367c58957e2d63

  • SHA512

    849557a31b08576b1be102767dbdf182b3f914d71c25bd3a25cc0e5748c9942ec41f910276a5f51b3f100a432443f0490b7f2fc4f1d3bd79cd22ca66291dde0b

  • SSDEEP

    1536:kAMDtajawvNhkim7VQe4tkYSWannmvZLVWn3M:PdPkim7VQjtkqnD83

Score
10/10

Malware Config

Extracted

Family

crimsonrat

C2

209.127.18.107

101.125.206.108

Signatures

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

  • Crimsonrat family

Processes

  • C:\Users\Admin\AppData\Local\Temp\b5c8e2afa1091e9513da06cfaa1ceed25e091692cdfe7f304e367c58957e2d63.exe
    "C:\Users\Admin\AppData\Local\Temp\b5c8e2afa1091e9513da06cfaa1ceed25e091692cdfe7f304e367c58957e2d63.exe"
    1⤵
      PID:2420

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2420-0-0x000007FEF5FB3000-0x000007FEF5FB4000-memory.dmp

      Filesize

      4KB

    • memory/2420-1-0x0000000000A80000-0x0000000001A48000-memory.dmp

      Filesize

      15.8MB

    • memory/2420-2-0x000007FEF5FB0000-0x000007FEF699C000-memory.dmp

      Filesize

      9.9MB

    • memory/2420-3-0x000007FEF5FB3000-0x000007FEF5FB4000-memory.dmp

      Filesize

      4KB

    • memory/2420-4-0x000007FEF5FB0000-0x000007FEF699C000-memory.dmp

      Filesize

      9.9MB