Overview
overview
10Static
static
10CraxsRatV3...er.exe
windows7-x64
7CraxsRatV3...er.exe
windows10-2004-x64
7CraxsRatV3...er.exe
windows7-x64
1CraxsRatV3...er.exe
windows10-2004-x64
1CraxsRatV3...er.exe
windows7-x64
1CraxsRatV3...er.exe
windows10-2004-x64
1CraxsRatV3...er.exe
windows7-x64
1CraxsRatV3...er.exe
windows10-2004-x64
1CraxsRatV3/cGeoIp.dll
windows7-x64
1CraxsRatV3/cGeoIp.dll
windows10-2004-x64
1CraxsRatV3/client.exe
windows7-x64
10CraxsRatV3/client.exe
windows10-2004-x64
10CraxsRatV3...rd.dll
windows7-x64
1CraxsRatV3...rd.dll
windows10-2004-x64
1CraxsRatV3...ta.exe
windows7-x64
1CraxsRatV3...ta.exe
windows10-2004-x64
1Analysis
-
max time kernel
141s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2023 00:16
Behavioral task
behavioral1
Sample
CraxsRatV3/Craxs-RAT-Builder.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
CraxsRatV3/Craxs-RAT-Builder.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
CraxsRatV3/Tools/HVNC-Server.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
CraxsRatV3/Tools/HVNC-Server.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
CraxsRatV3/Tools/ResHacker.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
CraxsRatV3/Tools/ResHacker.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
CraxsRatV3/Tools/vncviewer.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
CraxsRatV3/Tools/vncviewer.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
CraxsRatV3/cGeoIp.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
CraxsRatV3/cGeoIp.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
CraxsRatV3/client.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
CraxsRatV3/client.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
CraxsRatV3/netstandard.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
CraxsRatV3/netstandard.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
CraxsRatV3/resource/data.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
CraxsRatV3/resource/data.exe
Resource
win10v2004-20230220-en
General
-
Target
CraxsRatV3/Craxs-RAT-Builder.exe
-
Size
159KB
-
MD5
0d1b1c61a083b253810ede683435e6bc
-
SHA1
3a1c3f7a2d18d614a76d938d94b3af6f75580d9f
-
SHA256
fb486189117a81dcce0e772311fd220162e02214d37e6bdde408790e18d10bdb
-
SHA512
dc30d2428e2c1e14ca3a4243c8dd58f44068580a08d53480205086f43790b533579757a158118c9b45d8f15899437b9e305caa4a5a24e299a83fc51a057151e3
-
SSDEEP
1536:xdLBmgrojz6evQxNMBO1/pWhvCYbV7/9UtGwy7a37HM1Zgeroy:LUsojiMSBWhvX5C+GQ1J
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Craxs-RAT-Builder.exepid process 5064 Craxs-RAT-Builder.exe 5064 Craxs-RAT-Builder.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Craxs-RAT-Builder.exedescription pid process Token: SeDebugPrivilege 5064 Craxs-RAT-Builder.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5064-133-0x0000000000710000-0x000000000073E000-memory.dmpFilesize
184KB
-
memory/5064-134-0x0000000005630000-0x0000000005C48000-memory.dmpFilesize
6.1MB
-
memory/5064-135-0x0000000005090000-0x00000000050A2000-memory.dmpFilesize
72KB
-
memory/5064-136-0x00000000051C0000-0x00000000052CA000-memory.dmpFilesize
1.0MB
-
memory/5064-137-0x00000000050F0000-0x000000000512C000-memory.dmpFilesize
240KB
-
memory/5064-138-0x0000000005470000-0x0000000005480000-memory.dmpFilesize
64KB
-
memory/5064-139-0x0000000005480000-0x00000000054E6000-memory.dmpFilesize
408KB
-
memory/5064-140-0x0000000006500000-0x0000000006AA4000-memory.dmpFilesize
5.6MB
-
memory/5064-141-0x0000000006000000-0x0000000006092000-memory.dmpFilesize
584KB
-
memory/5064-142-0x00000000060A0000-0x00000000060F0000-memory.dmpFilesize
320KB
-
memory/5064-143-0x0000000006160000-0x00000000061D6000-memory.dmpFilesize
472KB
-
memory/5064-144-0x0000000006AB0000-0x0000000006C72000-memory.dmpFilesize
1.8MB
-
memory/5064-145-0x00000000071B0000-0x00000000076DC000-memory.dmpFilesize
5.2MB
-
memory/5064-146-0x00000000062A0000-0x00000000062BE000-memory.dmpFilesize
120KB