Analysis

  • max time kernel
    146s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-04-2024 12:24

General

  • Target

    CraxsRat 7.4 Cracked By @Hidden_Blaze/res/Lib/ApkEditor.jar

  • Size

    2.9MB

  • MD5

    2a86a4e2a358bdef45ebdb9b1ad217b6

  • SHA1

    6f1474287e6e6f4b1264e48eda8b88dfb7b7a47f

  • SHA256

    6bcda26492a031fc63b0d0f7b6b4590ef5017cdecc134ee9768521b03833fe00

  • SHA512

    1e4eec08a13e72567bd2e565ddf08a17d098e470280a057c8d4c31cfd501482fe7e381364f456a31cad1b0dae69e85140111e776bbd4b95c0a450d7d7f82baa0

  • SSDEEP

    49152:R5DHKV0tkwisQD+Dt+C4e/4sLbTJ8Jxi18ZqByspA7P41Mwsw3Ga:Lz00tkw9Qa+BegsLbS3ksP4Nn3h

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\ApkEditor.jar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:528
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:3024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    27668a4dec6370977488b727e0361aa5

    SHA1

    918a49fdc0ba053dfc19808fc1eb87f46016746e

    SHA256

    0f70a9e3cb1d24cc84693949530c4d5648282c683eee71411ab4257f4ecbb7da

    SHA512

    7077c2223e03cb5d206fecf65c50466d0948cc198e00b6ca2ce4073848805ecc292dbcc4bf50d0c4ca2af416bdc527a6afe3680d70f7fbf3697bcfc2c35ceef6

  • memory/528-4-0x0000019A2D580000-0x0000019A2E580000-memory.dmp

    Filesize

    16.0MB

  • memory/528-13-0x0000019A2BD30000-0x0000019A2BD31000-memory.dmp

    Filesize

    4KB