Overview
overview
7Static
static
7Accord.Vid...64.dll
windows10-2004-x64
1Accord.Video.dll
windows10-2004-x64
1Accord.dll
windows10-2004-x64
1ChangeLog.html
windows10-2004-x64
6CraxsRat v4.5.3.exe
windows10-2004-x64
1CraxsRat.exe.xml
windows10-2004-x64
1DrakeUI.Framework.dll
windows10-2004-x64
1GeoIPCitys.dll
windows10-2004-x64
1LiveCharts.MAPS.dll
windows10-2004-x64
1LiveCharts...ms.dll
windows10-2004-x64
1LiveCharts.Wpf.dll
windows10-2004-x64
1LiveCharts.dll
windows10-2004-x64
1LiveCharts...es.dll
windows10-2004-x64
3LiveChartsRegion.dll
windows10-2004-x64
3MetroSet UI.dll
windows10-2004-x64
1NAudio.dll
windows10-2004-x64
1System.IO....le.dll
windows10-2004-x64
1System.IO....on.dll
windows10-2004-x64
1Vip.Notification.dll
windows10-2004-x64
1WinMM.Net.dll
windows10-2004-x64
1avcodec-57.dll
windows10-2004-x64
3avdevice-57.dll
windows10-2004-x64
3avfilter-6.dll
windows10-2004-x64
1avformat-57.dll
windows10-2004-x64
3avutil-55.dll
windows10-2004-x64
3postproc-54.dll
windows10-2004-x64
1swresample-2.dll
windows10-2004-x64
1swscale-4.dll
windows10-2004-x64
3Analysis
-
max time kernel
110s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 22:59
Behavioral task
behavioral1
Sample
Accord.Video.FFMPEG.x64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
Accord.Video.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Accord.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral4
Sample
ChangeLog.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
CraxsRat v4.5.3.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
CraxsRat.exe.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
DrakeUI.Framework.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
GeoIPCitys.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
LiveCharts.MAPS.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
LiveCharts.WinForms.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
LiveCharts.Wpf.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
LiveCharts.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
LiveChartsCountries.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
LiveChartsRegion.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
MetroSet UI.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
NAudio.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
System.IO.Compression.ZipFile.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
System.IO.Compression.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Vip.Notification.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral20
Sample
WinMM.Net.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
avcodec-57.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
avdevice-57.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
avfilter-6.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
avformat-57.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
avutil-55.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
postproc-54.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral27
Sample
swresample-2.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
swscale-4.dll
Resource
win10v2004-20230220-en
General
-
Target
avutil-55.dll
-
Size
643KB
-
MD5
708905d347d1a8a7a3c4f23169a0caba
-
SHA1
da265d6e65570c94939673d0cd0eb66753c55e25
-
SHA256
fec199c1890759b8129195928e61f3a2f45f499a42610c207747b26e47b3caa8
-
SHA512
b99141c1bb1707bcdd49ad167ad0f9a004d283c439f06c82d06b4cfbcfd41a6595c6896b14a22a4670ac70e2db1dbbb6f5e0081e92a370818b96d95770effd55
-
SSDEEP
12288:3V15MRQeWTPw/yljXmoRzur2SqdyZYSRN2f3H5iKK:b5Mme46ylS1r2SqdyZYGV
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1712 3968 WerFault.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avutil-55.dll,#11⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3968 -s 3442⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 184 -p 3968 -ip 39681⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3968-133-0x00007FF9CAE60000-0x00007FF9CAF1D000-memory.dmpFilesize
756KB