Analysis
-
max time kernel
1793s -
max time network
1569s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 12:49
Behavioral task
behavioral1
Sample
CraxsRat-V3.7.1 Cracked.rar
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
CraxsRat-V3.7.1 Cracked.rar
Resource
win7-20240419-en
Behavioral task
behavioral3
Sample
CraxsRat-V3.7.1 Cracked.rar
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
CraxsRat-V3.7.1 Cracked.rar
Resource
win11-20240426-en
General
-
Target
CraxsRat-V3.7.1 Cracked.rar
-
Size
197.8MB
-
MD5
f1769f29bf5c820b1092e0c7b19bdf0a
-
SHA1
8d6e2877752f75f3e4e5c94c4a9c69aafbbabc4f
-
SHA256
8571fa43dbcece0d9eb72067409f75f805697ec166129fdb4a9bfc6317926765
-
SHA512
d8038004169e62ddbcbae4f5419ce2ec09d6779b0a9e1cd31467e515fafe5c1e7de75907385859ba814673f3da9438b10cf039e1cf643ef8291eccf17e8d50fb
-
SSDEEP
3145728:4y0PfiZVYuvnuJNiC0r89zqLXlglmWsSnuZT25OH5kN4NQ908t24lZT25OZbU3I5:4BiEau30r0Gxgkv5ykkRm0yP8SkR
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
rundll32.exerundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 2572 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 2572 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
vlc.exepid process 2572 vlc.exe 2572 vlc.exe 2572 vlc.exe 2572 vlc.exe 2572 vlc.exe 2572 vlc.exe 2572 vlc.exe 2572 vlc.exe 2572 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
vlc.exepid process 2572 vlc.exe 2572 vlc.exe 2572 vlc.exe 2572 vlc.exe 2572 vlc.exe 2572 vlc.exe 2572 vlc.exe 2572 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 2572 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exerundll32.exerundll32.exedescription pid process target process PID 2028 wrote to memory of 2636 2028 cmd.exe rundll32.exe PID 2028 wrote to memory of 2636 2028 cmd.exe rundll32.exe PID 2028 wrote to memory of 2636 2028 cmd.exe rundll32.exe PID 2636 wrote to memory of 2672 2636 rundll32.exe rundll32.exe PID 2636 wrote to memory of 2672 2636 rundll32.exe rundll32.exe PID 2636 wrote to memory of 2672 2636 rundll32.exe rundll32.exe PID 2672 wrote to memory of 2572 2672 rundll32.exe vlc.exe PID 2672 wrote to memory of 2572 2672 rundll32.exe vlc.exe PID 2672 wrote to memory of 2572 2672 rundll32.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\CraxsRat-V3.7.1 Cracked.rar"1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CraxsRat-V3.7.1 Cracked.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CraxsRat-V3.7.1 Cracked.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\CraxsRat-V3.7.1 Cracked.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2572-30-0x000007FEFA960000-0x000007FEFA994000-memory.dmpFilesize
208KB
-
memory/2572-29-0x000000013F750000-0x000000013F848000-memory.dmpFilesize
992KB
-
memory/2572-32-0x000007FEFA730000-0x000007FEFA748000-memory.dmpFilesize
96KB
-
memory/2572-33-0x000007FEF7850000-0x000007FEF7867000-memory.dmpFilesize
92KB
-
memory/2572-34-0x000007FEF75C0000-0x000007FEF75D1000-memory.dmpFilesize
68KB
-
memory/2572-35-0x000007FEF75A0000-0x000007FEF75B7000-memory.dmpFilesize
92KB
-
memory/2572-36-0x000007FEF7580000-0x000007FEF7591000-memory.dmpFilesize
68KB
-
memory/2572-38-0x000007FEF7030000-0x000007FEF7041000-memory.dmpFilesize
68KB
-
memory/2572-37-0x000007FEF7050000-0x000007FEF706D000-memory.dmpFilesize
116KB
-
memory/2572-31-0x000007FEF6070000-0x000007FEF6326000-memory.dmpFilesize
2.7MB
-
memory/2572-40-0x000007FEF5D30000-0x000007FEF5F3B000-memory.dmpFilesize
2.0MB
-
memory/2572-42-0x000007FEF69A0000-0x000007FEF69C1000-memory.dmpFilesize
132KB
-
memory/2572-46-0x000007FEF6960000-0x000007FEF6971000-memory.dmpFilesize
68KB
-
memory/2572-47-0x000007FEF5D10000-0x000007FEF5D2B000-memory.dmpFilesize
108KB
-
memory/2572-41-0x000007FEF69D0000-0x000007FEF6A11000-memory.dmpFilesize
260KB
-
memory/2572-44-0x000007FEF6B80000-0x000007FEF6B91000-memory.dmpFilesize
68KB
-
memory/2572-45-0x000007FEF6980000-0x000007FEF6991000-memory.dmpFilesize
68KB
-
memory/2572-49-0x000007FEF5CD0000-0x000007FEF5CE8000-memory.dmpFilesize
96KB
-
memory/2572-50-0x000007FEF5CA0000-0x000007FEF5CD0000-memory.dmpFilesize
192KB
-
memory/2572-56-0x000007FEF5AA0000-0x000007FEF5AC4000-memory.dmpFilesize
144KB
-
memory/2572-66-0x000007FEF1220000-0x000007FEF1236000-memory.dmpFilesize
88KB
-
memory/2572-65-0x000007FEF1240000-0x000007FEF1251000-memory.dmpFilesize
68KB
-
memory/2572-64-0x000007FEF1260000-0x000007FEF128F000-memory.dmpFilesize
188KB
-
memory/2572-63-0x000007FEFAF80000-0x000007FEFAF90000-memory.dmpFilesize
64KB
-
memory/2572-62-0x000007FEF6AD0000-0x000007FEF6AE1000-memory.dmpFilesize
68KB
-
memory/2572-61-0x000007FEF3AB0000-0x000007FEF3AC1000-memory.dmpFilesize
68KB
-
memory/2572-60-0x000007FEF5A10000-0x000007FEF5A22000-memory.dmpFilesize
72KB
-
memory/2572-67-0x000007FEF1150000-0x000007FEF1215000-memory.dmpFilesize
788KB
-
memory/2572-68-0x000007FEF1100000-0x000007FEF1142000-memory.dmpFilesize
264KB
-
memory/2572-59-0x000007FEF5A30000-0x000007FEF5A41000-memory.dmpFilesize
68KB
-
memory/2572-58-0x000007FEF5A50000-0x000007FEF5A73000-memory.dmpFilesize
140KB
-
memory/2572-57-0x000007FEF5A80000-0x000007FEF5A98000-memory.dmpFilesize
96KB
-
memory/2572-55-0x000007FEF5AD0000-0x000007FEF5AF8000-memory.dmpFilesize
160KB
-
memory/2572-69-0x000007FEF1090000-0x000007FEF10F2000-memory.dmpFilesize
392KB
-
memory/2572-54-0x000007FEF5B00000-0x000007FEF5B57000-memory.dmpFilesize
348KB
-
memory/2572-53-0x000007FEF5C10000-0x000007FEF5C21000-memory.dmpFilesize
68KB
-
memory/2572-52-0x000007FEF5B60000-0x000007FEF5BDC000-memory.dmpFilesize
496KB
-
memory/2572-51-0x000007FEF5C30000-0x000007FEF5C97000-memory.dmpFilesize
412KB
-
memory/2572-48-0x000007FEF5CF0000-0x000007FEF5D01000-memory.dmpFilesize
68KB
-
memory/2572-70-0x000007FEF1020000-0x000007FEF108D000-memory.dmpFilesize
436KB
-
memory/2572-43-0x000007FEF7010000-0x000007FEF7028000-memory.dmpFilesize
96KB
-
memory/2572-39-0x000007FEF43D0000-0x000007FEF5480000-memory.dmpFilesize
16.7MB