hxxps://github[.]com/crypterservice/CRAXS-RAT-V3-2023

Analysis

max time kernel
373s
max time network
376s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2023, 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/crypterservice/CRAXS-RAT-V3-2023

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
960	chrome.exe
960	chrome.exe
3420	chrome.exe
3420	chrome.exe
4260	chrome.exe
4260	chrome.exe
2244	chrome.exe
2244	chrome.exe
3396	chrome.exe
3396	chrome.exe
2036	chrome.exe
2036	chrome.exe
1460	chrome.exe
1460	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
4240	chrome.exe
4240	chrome.exe
4152	chrome.exe
4152	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	3372	7zG.exe
Token: 35	3372	7zG.exe
Token: SeSecurityPrivilege	3372	7zG.exe
Token: SeSecurityPrivilege	3372	7zG.exe
Token: SeRestorePrivilege	3208	7zG.exe
Token: 35	3208	7zG.exe
Token: SeSecurityPrivilege	3208	7zG.exe
Token: SeSecurityPrivilege	3208	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 2144	960	chrome.exe	82
PID 960 wrote to memory of 2144	960	chrome.exe	82
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4764	960	chrome.exe	85
PID 960 wrote to memory of 4704	960	chrome.exe	86
PID 960 wrote to memory of 4704	960	chrome.exe	86
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87
PID 960 wrote to memory of 4372	960	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://github.com/crypterservice/CRAXS-RAT-V3-2023
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff858d74f50,0x7ff858d74f60,0x7ff858d74f70
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1712 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2312 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1148 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4600 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:3456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3932

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap3795:96:7zEvent4886
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3372

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\CraxsRat V3 Crack\RAR PASSWORD.txt
1⤵
PID:3892

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\CraxsRat V3 Crack\" -an -ai#7zMap11012:120:7zEvent10110
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Downloads\CraxsRat V3 Crack.rar

Filesize
193.8MB

MD5
c94a8db54327d5f087902263325c98a5

SHA1
e0a3b9a8803103038d3758203b5857ec28dabeb3

SHA256
f65cb71124a756aa7859cc6eceb094553119e3b79de0d0ea98064034c6e6d892

SHA512
2f0fda38ee1ee4285ab8545f2c3b190691230ea72912969b1f79c0176c489428ac71e6206b94a3e622963136f3e0587b623934c9e25d96d4aece35d6dca511aa

Download Submit
C:\Users\Admin\Downloads\CraxsRat V3 Crack\CraxsRat V3.rar

Filesize
193.1MB

MD5
ff1eec621db4fb97f68e623b840251d1

SHA1
ba89365c48a39c11f81cbc2f73ea225c95104c25

SHA256
688955db779850776ca8eeaae42ad049bf1651deb603fd5d78ffe9872806d559

SHA512
b3945366d1f150c64a6273c94d21020be65b2b15a430db8e46cb543df00e0d573b79ba99b37b468bed109f2e803c7e220a2c9b057a4f9d971658cd7250948fdf

Download Submit
C:\Users\Admin\Downloads\CraxsRat V3 Crack\RAR PASSWORD.txt

Filesize
135B

MD5
9efe0d20692cd6934cd8ecdad6b9c066

SHA1
85c8a6a21a98c7cc1b928282dac8e5d0caad2996

SHA256
308de667f6477193362a6265ae08f11a05aeb6c3a158458b124d8db20b59a04a

SHA512
6edcffae83afb00d961b99e1998cfc665fab99ff07a23e1baf61f90532fe8157d1e6a00ef2fa5b56d355225dbc36559dae03e58e887febd451f03e05b9d5fa09

Download Submit