a6c11f14de0f3b87910785f97ae9618adda0d3b4a7616395d2b741c70881dc51

Analysis

max time kernel
1473s
max time network
1494s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
21-05-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CraxsRat 7.4/res/Lib/apktool.jar
Size

19.1MB
MD5

361f0c97e34aa93c7c1d8aa3e4828f69
SHA1

f19cead377b1db01b2c7e1348aebb40e071ec548
SHA256

bc2b9a87ac5a86905b6ca343c21a0db3bc37bdd51154bc9cdf65523d95895d34
SHA512

3cab65fe5cdbcc072f486281cbc1efde84eb0ecb5db52bd633c07640bf3f09fb79861df303e9c569f1399aa307226545ff0973039c31c3934a70890c6af5f48e
SSDEEP

393216:CkyM3Zw9Rt5P66rAHKFNn514GWU/zgY6tKJzlWhkvOS4eSa:CHoA5AKF7zR/t6tKF+iSa

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1960 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3936 wrote to memory of 1960 3936 java.exe icacls.exe
PID 3936 wrote to memory of 1960 3936 java.exe icacls.exe

pid	process
1960	icacls.exe

description	pid	process	target process
PID 3936 wrote to memory of 1960	3936	java.exe	icacls.exe
PID 3936 wrote to memory of 1960	3936	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4\res\Lib\apktool.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:3936

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1960

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
8fe56f700deacf43c694f8b6d561e202

SHA1
3afd8fd88c25723c10fd3bccecd19e387bc6ef54

SHA256
855da243d07f213910c2f54eaaafc9498afbf4913b645cfb86510ab9ec542117

SHA512
3e589d16de6bf0cf40714ff1a6872d071db529dc38f929bf9dae1c25c60a57db007869178c57b66634aa76cfeeb37650ba5655b8dd42fb4c3023e85a93b28758

Download Submit
memory/3936-2-0x00000286AAAF0000-0x00000286AAD60000-memory.dmp

Filesize
2.4MB

Download
memory/3936-12-0x00000286A9190000-0x00000286A9191000-memory.dmp

Filesize
4KB

Download
memory/3936-15-0x00000286A9190000-0x00000286A9191000-memory.dmp

Filesize
4KB

Download
memory/3936-16-0x00000286AAAF0000-0x00000286AAD60000-memory.dmp

Filesize
2.4MB

Download