Overview
overview
7Static
static
7CraxsRat 7...g.html
windows7-x64
1CraxsRat 7...g.html
windows10-2004-x64
1CraxsRat 7...ze.exe
windows7-x64
7CraxsRat 7...ze.exe
windows10-2004-x64
7CraxsRat 7...rk.dll
windows7-x64
1CraxsRat 7...rk.dll
windows10-2004-x64
1CraxsRat 7...ys.dll
windows7-x64
1CraxsRat 7...ys.dll
windows10-2004-x64
1CraxsRat 7...PS.dll
windows7-x64
1CraxsRat 7...PS.dll
windows10-2004-x64
1CraxsRat 7...ms.dll
windows7-x64
1CraxsRat 7...ms.dll
windows10-2004-x64
1CraxsRat 7...pf.dll
windows7-x64
1CraxsRat 7...pf.dll
windows10-2004-x64
1CraxsRat 7...ts.dll
windows7-x64
1CraxsRat 7...ts.dll
windows10-2004-x64
1CraxsRat 7...io.dll
windows7-x64
1CraxsRat 7...io.dll
windows10-2004-x64
1CraxsRat 7...on.dll
windows7-x64
1CraxsRat 7...on.dll
windows10-2004-x64
1CraxsRat 7...le.dll
windows7-x64
1CraxsRat 7...le.dll
windows10-2004-x64
1CraxsRat 7...et.dll
windows7-x64
1CraxsRat 7...et.dll
windows10-2004-x64
1CraxsRat 7...xs.dll
windows7-x64
1CraxsRat 7...xs.dll
windows10-2004-x64
1CraxsRat 7...7z.dll
windows7-x64
3CraxsRat 7...7z.dll
windows10-2004-x64
3CraxsRat 7...7z.exe
windows7-x64
7CraxsRat 7...7z.exe
windows10-2004-x64
7CraxsRat 7...or.jar
windows7-x64
1CraxsRat 7...or.jar
windows10-2004-x64
7Analysis
-
max time kernel
144s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 12:24
Behavioral task
behavioral1
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/ChangeLog.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/ChangeLog.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/CraxsRat CrackedBy @Hidden_Blaze.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/CraxsRat CrackedBy @Hidden_Blaze.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral5
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/DrakeUI.Framework.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/DrakeUI.Framework.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/GeoIPCitys.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/GeoIPCitys.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/LiveCharts.MAPS.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/LiveCharts.MAPS.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/LiveCharts.WinForms.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/LiveCharts.WinForms.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/LiveCharts.Wpf.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/LiveCharts.Wpf.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/LiveCharts.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/LiveCharts.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/NAudio.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/NAudio.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/Newtonsoft.Json.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/Newtonsoft.Json.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/System.IO.Compression.ZipFile.dll
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/System.IO.Compression.ZipFile.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/WinMM.Net.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/WinMM.Net.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral25
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/craxs.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/craxs.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/res/Lib/7z.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/res/Lib/7z.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/res/Lib/7z.exe
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/res/Lib/7z.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/res/Lib/ApkEditor.jar
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
CraxsRat 7.4 Cracked By @Hidden_Blaze/res/Lib/ApkEditor.jar
Resource
win10v2004-20240226-en
General
-
Target
CraxsRat 7.4 Cracked By @Hidden_Blaze/res/Lib/7z.exe
-
Size
1.0MB
-
MD5
c90af375bc40d0506c16b4ed75efccb6
-
SHA1
cd29f79b128ba67bc30e44e7a0365c5ffd3be376
-
SHA256
c6e3aa8b8b76b9e3b9df71b3f31d1b7a23f2a031099aceb68c39f38945b65dc0
-
SHA512
f0f9e9f6d92ebf20a5303be38e41f66fd052141f04db14ad1d30c974a4e4e70abd51340fe92658563bdb6a7587d9117883241de5bdd123a6e259123869dbabaa
-
SSDEEP
24576:xnsJ39LyjbJkQFMhmC+6GD9P377SqLk2JC5RzHl:xnsHyjtk2MYC5GDR77k2OHl
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7z.exeSynaptics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 7z.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
Processes:
._cache_7z.exeSynaptics.exe._cache_Synaptics.exepid process 1692 ._cache_7z.exe 1168 Synaptics.exe 3656 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7z.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\????? = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 7z.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
7z.exeSynaptics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 7z.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
._cache_Synaptics.exedescription pid process Token: SeRestorePrivilege 3656 ._cache_Synaptics.exe Token: 35 3656 ._cache_Synaptics.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
7z.exeSynaptics.exedescription pid process target process PID 4544 wrote to memory of 1692 4544 7z.exe ._cache_7z.exe PID 4544 wrote to memory of 1692 4544 7z.exe ._cache_7z.exe PID 4544 wrote to memory of 1692 4544 7z.exe ._cache_7z.exe PID 4544 wrote to memory of 1168 4544 7z.exe Synaptics.exe PID 4544 wrote to memory of 1168 4544 7z.exe Synaptics.exe PID 4544 wrote to memory of 1168 4544 7z.exe Synaptics.exe PID 1168 wrote to memory of 3656 1168 Synaptics.exe ._cache_Synaptics.exe PID 1168 wrote to memory of 3656 1168 Synaptics.exe ._cache_Synaptics.exe PID 1168 wrote to memory of 3656 1168 Synaptics.exe ._cache_Synaptics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\7z.exe"C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\7z.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\._cache_7z.exe"C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\._cache_7z.exe"2⤵
- Executes dropped EXE
PID:1692
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3656
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5c90af375bc40d0506c16b4ed75efccb6
SHA1cd29f79b128ba67bc30e44e7a0365c5ffd3be376
SHA256c6e3aa8b8b76b9e3b9df71b3f31d1b7a23f2a031099aceb68c39f38945b65dc0
SHA512f0f9e9f6d92ebf20a5303be38e41f66fd052141f04db14ad1d30c974a4e4e70abd51340fe92658563bdb6a7587d9117883241de5bdd123a6e259123869dbabaa
-
Filesize
329KB
MD5453821572a13cc6ea0736f9db6424e13
SHA15f994bde8db4b658781756eaaca9416909a3a420
SHA256b8c3871a5d6a473a2e9d08684a481aea7467a97d0a433cf55b127323ef61218f
SHA51222468064ae306037d2b241e8a985ad5b037b45f6873e364f46d8066018533993e66834288227ae86e94e23511386f0afcf52776060b17dad11dfba4bc333b07a