Overview
overview
10Static
static
7ChangeLog.html
windows10-1703-x64
1CraxsRat.exe.xml
windows10-1703-x64
1CraxsRat.xml
windows10-1703-x64
1License.xml
windows10-1703-x64
1LiveCharts.Wpf.xml
windows10-1703-x64
1SimplicLoader.exe
windows10-1703-x64
10System.IO....le.dll
windows10-1703-x64
1Vip.Notification.dll
windows10-1703-x64
1WinMM.Net.dll
windows10-1703-x64
1Analysis
-
max time kernel
603s -
max time network
862s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
11/04/2023, 20:30
Behavioral task
behavioral1
Sample
ChangeLog.html
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
CraxsRat.exe.xml
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
CraxsRat.xml
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
License.xml
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
LiveCharts.Wpf.xml
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
SimplicLoader.exe
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
System.IO.Compression.ZipFile.dll
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
Vip.Notification.dll
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
WinMM.Net.dll
Resource
win10-20230220-en
General
-
Target
CraxsRat.exe.xml
-
Size
7KB
-
MD5
dd5a0508827ec5ef25064c18fbd73c79
-
SHA1
32f9a8803107d28418437312fd0e52e564f0f753
-
SHA256
fdd077b07e6edd22678b2a29beee104daffdf56d545bbae1f39c632208a61d74
-
SHA512
6fa7e2407b412e471c42162d460625e17a7dc7b76b0a236db1746645f75cf38806026f1084b254da204ce149e960da1a7897e472c58fe71151435fb94ae012e6
-
SSDEEP
96:ur71tp7K0rjtHyZ90nDP9SbujEBKgFAnuAnznVuupxZAEcHn4abLQAntYIWVv/xb:ur7rp7vrjaHyv
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388017306" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "388065891" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "388033900" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2274572062" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2290978821" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31026373" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31026373" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2274572062" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a702c863227b745aefca3d2bb9571e800000000020000000000106600000001000020000000f913dc3ed325891cbc0cb4139d1e72472451e2b71d03147b6306805fa36ca34d000000000e8000000002000020000000f6c8f02abe5e143f0428385a8971abe932f2306e7bb22708592797bc3ce3dcb020000000421567928d042a56dc4a7551bee7d4d3cebeebb209d23498ccdc9c5777f1a70c400000006a551f7fd6ec3f78e6f57f035a604aecf89390193739b362de5b42ebc1f85d1229eb09bc317c602af9f7bf7594b21601c3a098c6470c6a6c92d4666a5b228c9e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01a5889c56cd901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B28522FC-D8B8-11ED-8E3B-FEFF0DC94917} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31026373" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e36889c56cd901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a702c863227b745aefca3d2bb9571e800000000020000000000106600000001000020000000d1abedd02dc65e303836ddb3db10ac6f11610802d682d479559e30950c4bf3dc000000000e8000000002000020000000bc962271b543a31aa77b44c7d885197ff540840b8216c0a84b25f8c4a07ff84f20000000da6751827b52f2c042465d43d50db2d54a23888545c1241d2fb2950c03ce01d240000000c96e3087d2f8ee0fd9e3f41dd4ca2533123241066ed800f8c582c6681f10f4ac03f69e13b04b5e47d0b3d911d0ed0ee7f9b102a619a2ac4388fee56ede091544 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3940 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3940 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3940 iexplore.exe 3940 iexplore.exe 4920 IEXPLORE.EXE 4920 IEXPLORE.EXE 4920 IEXPLORE.EXE 4920 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4748 wrote to memory of 3940 4748 MSOXMLED.EXE 66 PID 4748 wrote to memory of 3940 4748 MSOXMLED.EXE 66 PID 3940 wrote to memory of 4920 3940 iexplore.exe 68 PID 3940 wrote to memory of 4920 3940 iexplore.exe 68 PID 3940 wrote to memory of 4920 3940 iexplore.exe 68
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\CraxsRat.exe.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\CraxsRat.exe.xml2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3940 CREDAT:82945 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4920
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD537c79f76883dd7f46fb18326bbc6ae91
SHA1e497f7d518a547dadd6b87db925199d2bc2028bb
SHA25681d26deef623c5fdacc7c28350ebe71621f0625d70b54bc95775fa50c8ddb3f2
SHA5121f002f0b666a353788c7dae6eea63a33191f7fceea215570b9a6d39f80784fd0f6fa64abc5e01a41a563828176d0004f0f4044f7836db7bdc1aa8972f8c7deb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD5b890252faddd1830d9e6dd192aafde63
SHA11cabfe01ebbea0819eca1ea46fb7ab744b3f4b45
SHA256205a5b18b5b3ca641ce56cf9f8865e36ef5dd23c39a3e6b7f9936aba7ae61c4e
SHA5129ce5acbc7e1f1b0be7d3f1aec73cef7b383f633b668cb0638a3ecad2e62ade9fcd2940cbe6cb8bbf4c7638dec628d3aa435c009b3e5a9b9b3177b77d3a62be29
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
615B
MD5abd9d6ff93257110720e7701a7928f73
SHA13b1108b89324b47691043a1110630341d6ab9a54
SHA256e9c90fdf71d987b4de64995859e9ae20a3eaaa257609bc0aa35624e944bc8d8e
SHA51282be6d865d105b4c2dc43576642147b7317399558daabb351db194e375bfde1ec76d792d3a1d4afaa732b1444a06c99d6635429092acbb3cced8f9ce11148610