Overview
overview
7Static
static
7CraxRat V4...CK.exe
windows10-1703-x64
7CraxRat V4...es.dll
windows10-1703-x64
3CraxRat V4...on.dll
windows10-1703-x64
3CraxRat V4...UI.dll
windows10-1703-x64
1CraxRat V4...io.dll
windows10-1703-x64
1CraxRat V4...le.dll
windows10-1703-x64
1CraxRat V4...on.dll
windows10-1703-x64
1CraxRat V4...V4.exe
windows10-1703-x64
3CraxRat V4...ck.exe
windows10-1703-x64
7Resubmissions
24-05-2023 12:03
230524-n8dbgscd25 7Analysis
-
max time kernel
125s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
24-05-2023 12:03
Behavioral task
behavioral1
Sample
CraxRat V4 CRACK/CraxRat V4 CRACK.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
CraxRat V4 CRACK/LiveChartsCountries.dll
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
CraxRat V4 CRACK/LiveChartsRegion.dll
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
CraxRat V4 CRACK/MetroSet UI.dll
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
CraxRat V4 CRACK/NAudio.dll
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
CraxRat V4 CRACK/System.IO.Compression.ZipFile.dll
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
CraxRat V4 CRACK/System.IO.Compression.dll
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
CraxRat V4 CRACK/V4.exe
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
CraxRat V4 CRACK/res/Plugins/Android/crack.exe
Resource
win10-20230220-en
General
-
Target
CraxRat V4 CRACK/V4.exe
-
Size
40.9MB
-
MD5
2c3de095ad1ad12d56c4656642c4e541
-
SHA1
f8925dc9c68895958961a5c01e989f622f644f0c
-
SHA256
85e1519a11df4b2c6d36d64536fb1070cd6cdd01da502056aab2a01b468016c3
-
SHA512
5be44b6e3c99847f8507e1ba32f2fa157b6da8cf09f7baf12030bd57f29c5872e2d5934cc64836b2de98242422f4d91b9224071b041f48b539e6f23e6d3ebcac
-
SSDEEP
786432:Thyqe9n+N5GsjzKGCGWdo3LuqIXwfWeY6VQoJOjzTheSsXaKAoija5w9Fm:NtOn+uLGCG6qOgfzbUjzTDyadoea5g
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1228 4152 WerFault.exe 66 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4152 V4.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4152 V4.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4152 V4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CraxRat V4 CRACK\V4.exe"C:\Users\Admin\AppData\Local\Temp\CraxRat V4 CRACK\V4.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4152 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4152 -s 34562⤵
- Program crash
PID:1228
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\32f05a392f7449e498d001d217286384 /t 4136 /p 41521⤵PID:3380
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\EVLF_-_t.me_evlfdev\V4.exe_Url_ou1ripe5ial3gaahnnaenrl5dbdncmt4\4.0.0.0\user.config
Filesize798B
MD586c914fa834005a5d28df952ffee11ae
SHA1a29db77bcfce72901891a905bc040b8b405a74cc
SHA256ec020c677fc4a530bcc292e6f3946820ddb2b3ef8641edb6a6a7f091218fbf6d
SHA51261cf656dc5736686e214d855200bea66a22155193d4d1254813b6087992567bb1ffb5780df4b58401f150371093198c9013a99b5632ac57a46a3ae34c541d667