Overview
overview
7Static
static
7craxs/Agil...me.dll
windows10-2004-x64
1craxs/ChangeLog.html
windows10-2004-x64
1craxs/Crax...xe.xml
windows10-2004-x64
1craxs/Crax....1.exe
windows10-2004-x64
3craxs/Drak...rk.dll
windows10-2004-x64
1craxs/GeoIPCitys.dll
windows10-2004-x64
1craxs/Live...ms.dll
windows10-2004-x64
1craxs/Live...pf.dll
windows10-2004-x64
1craxs/LiveCharts.dll
windows10-2004-x64
1craxs/MetroSet UI.dll
windows10-2004-x64
1craxs/NAudio.dll
windows10-2004-x64
1craxs/Syst...le.dll
windows10-2004-x64
1craxs/Vip....on.dll
windows10-2004-x64
1craxs/WinMM.Net.dll
windows10-2004-x64
1craxs/mscorlib.dll
windows10-2004-x64
1craxs/res/...-1.dex
windows10-2004-x64
3craxs/res/...n-2.pl
windows10-2004-x64
3craxs/res/...n-3.pl
windows10-2004-x64
3craxs/res/...-4.dex
windows10-2004-x64
3craxs/res/...-5.dex
windows10-2004-x64
3craxs/res/...n-6.pl
windows10-2004-x64
3craxs/res/...n-7.pl
windows10-2004-x64
3craxs/res/...n-8.pl
windows10-2004-x64
3Analysis
-
max time kernel
59s -
max time network
77s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2023 15:11
Behavioral task
behavioral1
Sample
craxs/AgileDotNet.VMRuntime.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
craxs/ChangeLog.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
craxs/CraxsRat.exe.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
craxs/CraxsRat3.7.1.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
craxs/DrakeUI.Framework.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral6
Sample
craxs/GeoIPCitys.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
craxs/LiveCharts.WinForms.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
craxs/LiveCharts.Wpf.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
craxs/LiveCharts.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
craxs/MetroSet UI.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
craxs/NAudio.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
craxs/System.IO.Compression.ZipFile.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
craxs/Vip.Notification.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
craxs/WinMM.Net.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
craxs/mscorlib.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
craxs/res/Plugins/Android/gen-1.dex
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
craxs/res/Plugins/Android/gen-2.pl
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
craxs/res/Plugins/Android/gen-3.pl
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
craxs/res/Plugins/Android/gen-4.dex
Resource
win10v2004-20230221-en
Behavioral task
behavioral20
Sample
craxs/res/Plugins/Android/gen-5.dex
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
craxs/res/Plugins/Android/gen-6.pl
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
craxs/res/Plugins/Android/gen-7.pl
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
craxs/res/Plugins/Android/gen-8.pl
Resource
win10v2004-20230220-en
General
-
Target
craxs/CraxsRat.exe.xml
-
Size
7KB
-
MD5
dd5a0508827ec5ef25064c18fbd73c79
-
SHA1
32f9a8803107d28418437312fd0e52e564f0f753
-
SHA256
fdd077b07e6edd22678b2a29beee104daffdf56d545bbae1f39c632208a61d74
-
SHA512
6fa7e2407b412e471c42162d460625e17a7dc7b76b0a236db1746645f75cf38806026f1084b254da204ce149e960da1a7897e472c58fe71151435fb94ae012e6
-
SSDEEP
96:ur71tp7K0rjtHyZ90nDP9SbujEBKgFAnuAnznVuupxZAEcHn4abLQAntYIWVv/xb:ur7rp7vrjaHyv
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3993353156" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31020486" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a062d0eec655d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{182F6844-C1BA-11ED-9F77-4221DB3A75C8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038a9e23718fe574b84afdc36f043bb4c00000000020000000000106600000001000020000000a31ac31b491fd0da415bd6595025b9bebd25dc468ec5718ede1b3e9e8fff4a44000000000e8000000002000020000000ec074cb5e658253389410f71d51564acdc5f05cb927bac687b9542dd7a2da8df200000002d7fa03c4a13a574eb50c2f3b62e47e015fe71e5b1187b2d95a8b969aa32581b400000006c2fa2b9b9ae539af4e341cfa46de62759d65af5fb092d8abaa4be5441f2e5c7a71dd000c21106701b125f41a5dbb4a1e0224e5555cb421e14ff3e40a1cdd648 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31020486" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038a9e23718fe574b84afdc36f043bb4c0000000002000000000010660000000100002000000099d69d88ac25e62c2df7a04338442e1d65bfa6263ab0fe69f73d8174b7081939000000000e800000000200002000000068c7432b0ad5c557367d22170873703d62b5607a094d169ecb1ec5d8c65160842000000000b99b69f68fbc56a1668e5a10e7c2addb4eff1b2c83b28ca3fd9a993690e8324000000059a7778d3b20061c2b0cf47c40f8aeef1d216194821863c9d91fc282d5fa1e09d4937a9264e597561db73edb0dde5843c90eca5ca71f0df6c754a02c0f2d1c4a iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3979603858" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3979603858" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31020486" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7093deeec655d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 5000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 5000 iexplore.exe 5000 iexplore.exe 5096 IEXPLORE.EXE 5096 IEXPLORE.EXE 5096 IEXPLORE.EXE 5096 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 380 wrote to memory of 5000 380 MSOXMLED.EXE iexplore.exe PID 380 wrote to memory of 5000 380 MSOXMLED.EXE iexplore.exe PID 5000 wrote to memory of 5096 5000 iexplore.exe IEXPLORE.EXE PID 5000 wrote to memory of 5096 5000 iexplore.exe IEXPLORE.EXE PID 5000 wrote to memory of 5096 5000 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\craxs\CraxsRat.exe.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\craxs\CraxsRat.exe.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5000 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/380-133-0x00007FFFA5170000-0x00007FFFA5180000-memory.dmpFilesize
64KB
-
memory/380-134-0x00007FFFA5170000-0x00007FFFA5180000-memory.dmpFilesize
64KB
-
memory/380-135-0x00007FFFA5170000-0x00007FFFA5180000-memory.dmpFilesize
64KB
-
memory/380-136-0x00007FFFA5170000-0x00007FFFA5180000-memory.dmpFilesize
64KB
-
memory/380-137-0x00007FFFA5170000-0x00007FFFA5180000-memory.dmpFilesize
64KB
-
memory/380-138-0x00007FFFA5170000-0x00007FFFA5180000-memory.dmpFilesize
64KB
-
memory/380-139-0x00007FFFA5170000-0x00007FFFA5180000-memory.dmpFilesize
64KB
-
memory/380-140-0x00007FFFA5170000-0x00007FFFA5180000-memory.dmpFilesize
64KB
-
memory/380-141-0x00007FFFA5170000-0x00007FFFA5180000-memory.dmpFilesize
64KB