Overview
overview
7Static
static
7CraxsRat-V...me.dll
windows10-2004-x64
1CraxsRat-V...g.html
windows10-2004-x64
1CraxsRat-V....1.exe
windows10-2004-x64
1CraxsRat-V...xe.xml
windows10-2004-x64
1CraxsRat-V...rk.dll
windows10-2004-x64
1CraxsRat-V...ys.dll
windows10-2004-x64
1CraxsRat-V...ms.dll
windows10-2004-x64
1CraxsRat-V...pf.dll
windows10-2004-x64
1CraxsRat-V...ts.dll
windows10-2004-x64
1CraxsRat-V...es.dll
windows10-2004-x64
3CraxsRat-V...on.dll
windows10-2004-x64
3CraxsRat-V...UI.dll
windows10-2004-x64
1CraxsRat-V...io.dll
windows10-2004-x64
1CraxsRat-V...le.dll
windows10-2004-x64
1CraxsRat-V...on.dll
windows10-2004-x64
1CraxsRat-V...on.dll
windows10-2004-x64
1CraxsRat-V...et.dll
windows10-2004-x64
1CraxsRat-V...-1.dex
windows10-2004-x64
3CraxsRat-V...n-2.pl
windows10-2004-x64
3CraxsRat-V...n-3.pl
windows10-2004-x64
3CraxsRat-V...-4.dex
windows10-2004-x64
3CraxsRat-V...-5.dex
windows10-2004-x64
3CraxsRat-V...n-6.pl
windows10-2004-x64
3CraxsRat-V...n-7.pl
windows10-2004-x64
3CraxsRat-V...n-8.pl
windows10-2004-x64
3Analysis
-
max time kernel
61s -
max time network
79s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2023 07:46
Behavioral task
behavioral1
Sample
CraxsRat-V3.9.1/AgileDotNet.VMRuntime.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
CraxsRat-V3.9.1/ChangeLog.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
CraxsRat-V3.9.1/CraxsRat 3.9.1.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
CraxsRat-V3.9.1/CraxsRat.exe.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
CraxsRat-V3.9.1/DrakeUI.Framework.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
CraxsRat-V3.9.1/GeoIPCitys.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
CraxsRat-V3.9.1/LiveCharts.WinForms.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
CraxsRat-V3.9.1/LiveCharts.Wpf.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
CraxsRat-V3.9.1/LiveCharts.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
CraxsRat-V3.9.1/LiveChartsCountries.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
CraxsRat-V3.9.1/LiveChartsRegion.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral12
Sample
CraxsRat-V3.9.1/MetroSet UI.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
CraxsRat-V3.9.1/NAudio.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
CraxsRat-V3.9.1/System.IO.Compression.ZipFile.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
CraxsRat-V3.9.1/System.IO.Compression.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
CraxsRat-V3.9.1/Vip.Notification.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral17
Sample
CraxsRat-V3.9.1/WinMM.Net.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
CraxsRat-V3.9.1/res/Plugins/Android/gen-1.dex
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
CraxsRat-V3.9.1/res/Plugins/Android/gen-2.pl
Resource
win10v2004-20230220-en
Behavioral task
behavioral20
Sample
CraxsRat-V3.9.1/res/Plugins/Android/gen-3.pl
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
CraxsRat-V3.9.1/res/Plugins/Android/gen-4.dex
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
CraxsRat-V3.9.1/res/Plugins/Android/gen-5.dex
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
CraxsRat-V3.9.1/res/Plugins/Android/gen-6.pl
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
CraxsRat-V3.9.1/res/Plugins/Android/gen-7.pl
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
CraxsRat-V3.9.1/res/Plugins/Android/gen-8.pl
Resource
win10v2004-20230220-en
General
-
Target
CraxsRat-V3.9.1/CraxsRat.exe.xml
-
Size
7KB
-
MD5
f87638ec318fabd7471dcd13057408fd
-
SHA1
d948d6ce8091f3a4e82a261be01e41146d86d09e
-
SHA256
ffce1e0cbbc9efb406b2ac43fcfdae3d6b3cf7b77195649cf416c35bddaddf3c
-
SHA512
1c674b715926bb0f645e4f2b8647dc830463f45f9f2281c6cdebf9d271a7927af52c2cf00e7259c3455fc798b95b2d05d1a034b8b862ffbed3b400562e68c525
-
SSDEEP
96:ur7V7KorTZHyZ90nDP9SbujEBKgFAnuAnznVuupxZAEcHn4abLQAntYIWVv/xWpA:ur7V79rqHm
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31030290" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038a9e23718fe574b84afdc36f043bb4c0000000002000000000010660000000100002000000081dbfef97b0b1997fef15e204b1f8b0e87b259c2617bd49e9f9db3c5cc638a3c000000000e80000000020000200000003901cf5f1139e1b4a9044bc7b4fb23baecac8ac4793f0453045921488c0559a52000000021ce5326ade489b4aa9fd686b267d34f3c7d091dab20c0d5dc07b2d3197322e440000000a5d66c0e2a583aa9a35470569322bde3eedac3835651b02d5d987c6763bb7e2ea5ced13480c2baff169f209266aa7ed0f8cc63119c2b5a24b0f51fd7d9cc8935 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c0107f127cd901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31030290" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038a9e23718fe574b84afdc36f043bb4c00000000020000000000106600000001000020000000ec84423dc89f08f48ca890546649998b0e5b166c3331b3ab3eff9230541189ea000000000e8000000002000020000000a3611a85b22aff59334169c3a8f9ae25ce2685909e5d42eec224affabf9fc6b320000000d747f4fa48333ef21bf45d3c85174c9419c41a5f751ffd7b7af2280fbd84fd03400000003dcfc87c1a4d758fc8997a3e4321662e7cfca52ed890d98bc5688471bbedec8aa4b38adc3b8a2e5a3b3bc5ada941e7c38691910be3471bea31a81fff9afb28d9 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31030290" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A68BDF34-E805-11ED-9F77-E63637889D5B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2075247625" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2075247625" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2102125498" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b016657e127cd901 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3712 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3712 iexplore.exe 3712 iexplore.exe 3284 IEXPLORE.EXE 3284 IEXPLORE.EXE 3284 IEXPLORE.EXE 3284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 2032 wrote to memory of 3712 2032 MSOXMLED.EXE iexplore.exe PID 2032 wrote to memory of 3712 2032 MSOXMLED.EXE iexplore.exe PID 3712 wrote to memory of 3284 3712 iexplore.exe IEXPLORE.EXE PID 3712 wrote to memory of 3284 3712 iexplore.exe IEXPLORE.EXE PID 3712 wrote to memory of 3284 3712 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\CraxsRat-V3.9.1\CraxsRat.exe.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\CraxsRat-V3.9.1\CraxsRat.exe.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3712 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3284
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2032-133-0x00007FFEAE470000-0x00007FFEAE480000-memory.dmpFilesize
64KB
-
memory/2032-134-0x00007FFEAE470000-0x00007FFEAE480000-memory.dmpFilesize
64KB
-
memory/2032-135-0x00007FFEAE470000-0x00007FFEAE480000-memory.dmpFilesize
64KB
-
memory/2032-136-0x00007FFEAE470000-0x00007FFEAE480000-memory.dmpFilesize
64KB
-
memory/2032-137-0x00007FFEAE470000-0x00007FFEAE480000-memory.dmpFilesize
64KB
-
memory/2032-138-0x00007FFEAE470000-0x00007FFEAE480000-memory.dmpFilesize
64KB
-
memory/2032-139-0x00007FFEAE470000-0x00007FFEAE480000-memory.dmpFilesize
64KB
-
memory/2032-140-0x00007FFEAE470000-0x00007FFEAE480000-memory.dmpFilesize
64KB
-
memory/2032-141-0x00007FFEAE470000-0x00007FFEAE480000-memory.dmpFilesize
64KB