Analysis
-
max time kernel
1793s -
max time network
1571s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 12:55
Behavioral task
behavioral1
Sample
CraxsRat_V5.2.rar
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
CraxsRat_V5.2.rar
Resource
win7-20240508-en
Behavioral task
behavioral3
Sample
CraxsRat_V5.2.rar
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
CraxsRat_V5.2.rar
Resource
win11-20240426-en
General
-
Target
CraxsRat_V5.2.rar
-
Size
280.5MB
-
MD5
c9e8580a7e40d0d50baa997f27393db7
-
SHA1
068f0ac8b0d4a7ff814e1ac609096aa5acf09db4
-
SHA256
9f920df08ba4bb959cdcaeb531701e1a699f78eb9c3772f796e26cb5c2081cd6
-
SHA512
61f05f838de734dd9d16014448f8ec3db98ac25b32f89f065893f2d32a4296e80706ce5158d2ca209602936caa6256bb1c9f3999f776520f117508b0bbac984d
-
SSDEEP
6291456:Zsc2kUiefaoX6GVz+DVATrAPd5ykkRm0yP8Sk+D:R2kUieDnVzqVmrAFbd78mD
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
rundll32.exerundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 1452 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 1452 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
vlc.exepid process 1452 vlc.exe 1452 vlc.exe 1452 vlc.exe 1452 vlc.exe 1452 vlc.exe 1452 vlc.exe 1452 vlc.exe 1452 vlc.exe 1452 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
vlc.exepid process 1452 vlc.exe 1452 vlc.exe 1452 vlc.exe 1452 vlc.exe 1452 vlc.exe 1452 vlc.exe 1452 vlc.exe 1452 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 1452 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exerundll32.exerundll32.exedescription pid process target process PID 1920 wrote to memory of 2616 1920 cmd.exe rundll32.exe PID 1920 wrote to memory of 2616 1920 cmd.exe rundll32.exe PID 1920 wrote to memory of 2616 1920 cmd.exe rundll32.exe PID 2616 wrote to memory of 2808 2616 rundll32.exe rundll32.exe PID 2616 wrote to memory of 2808 2616 rundll32.exe rundll32.exe PID 2616 wrote to memory of 2808 2616 rundll32.exe rundll32.exe PID 2808 wrote to memory of 1452 2808 rundll32.exe vlc.exe PID 2808 wrote to memory of 1452 2808 rundll32.exe vlc.exe PID 2808 wrote to memory of 1452 2808 rundll32.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\CraxsRat_V5.2.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CraxsRat_V5.2.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CraxsRat_V5.2.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\CraxsRat_V5.2.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1452-30-0x000007FEFAB70000-0x000007FEFABA4000-memory.dmpFilesize
208KB
-
memory/1452-29-0x000000013F5E0000-0x000000013F6D8000-memory.dmpFilesize
992KB
-
memory/1452-32-0x000007FEFAB50000-0x000007FEFAB68000-memory.dmpFilesize
96KB
-
memory/1452-33-0x000007FEFAB30000-0x000007FEFAB47000-memory.dmpFilesize
92KB
-
memory/1452-34-0x000007FEFAB10000-0x000007FEFAB21000-memory.dmpFilesize
68KB
-
memory/1452-35-0x000007FEFAAF0000-0x000007FEFAB07000-memory.dmpFilesize
92KB
-
memory/1452-36-0x000007FEF7DF0000-0x000007FEF7E01000-memory.dmpFilesize
68KB
-
memory/1452-38-0x000007FEF7DB0000-0x000007FEF7DC1000-memory.dmpFilesize
68KB
-
memory/1452-31-0x000007FEF5D20000-0x000007FEF5FD6000-memory.dmpFilesize
2.7MB
-
memory/1452-37-0x000007FEF7DD0000-0x000007FEF7DED000-memory.dmpFilesize
116KB
-
memory/1452-39-0x000007FEF5890000-0x000007FEF5A9B000-memory.dmpFilesize
2.0MB
-
memory/1452-41-0x000007FEF6F70000-0x000007FEF6FB1000-memory.dmpFilesize
260KB
-
memory/1452-44-0x000007FEF6F00000-0x000007FEF6F11000-memory.dmpFilesize
68KB
-
memory/1452-45-0x000007FEF6360000-0x000007FEF6371000-memory.dmpFilesize
68KB
-
memory/1452-43-0x000007FEF6F20000-0x000007FEF6F38000-memory.dmpFilesize
96KB
-
memory/1452-42-0x000007FEF6F40000-0x000007FEF6F61000-memory.dmpFilesize
132KB
-
memory/1452-46-0x000007FEF47C0000-0x000007FEF47D1000-memory.dmpFilesize
68KB
-
memory/1452-47-0x000007FEF47A0000-0x000007FEF47BB000-memory.dmpFilesize
108KB
-
memory/1452-51-0x000007FEF46C0000-0x000007FEF4727000-memory.dmpFilesize
412KB
-
memory/1452-53-0x000007FEF4620000-0x000007FEF4631000-memory.dmpFilesize
68KB
-
memory/1452-54-0x000007FEF45C0000-0x000007FEF4617000-memory.dmpFilesize
348KB
-
memory/1452-52-0x000007FEF4640000-0x000007FEF46BC000-memory.dmpFilesize
496KB
-
memory/1452-57-0x000007FEF4540000-0x000007FEF4558000-memory.dmpFilesize
96KB
-
memory/1452-50-0x000007FEF4730000-0x000007FEF4760000-memory.dmpFilesize
192KB
-
memory/1452-49-0x000007FEF4760000-0x000007FEF4778000-memory.dmpFilesize
96KB
-
memory/1452-48-0x000007FEF4780000-0x000007FEF4791000-memory.dmpFilesize
68KB
-
memory/1452-60-0x000007FEF44D0000-0x000007FEF44E2000-memory.dmpFilesize
72KB
-
memory/1452-59-0x000007FEF44F0000-0x000007FEF4501000-memory.dmpFilesize
68KB
-
memory/1452-58-0x000007FEF4510000-0x000007FEF4533000-memory.dmpFilesize
140KB
-
memory/1452-56-0x000007FEF4560000-0x000007FEF4584000-memory.dmpFilesize
144KB
-
memory/1452-55-0x000007FEF4590000-0x000007FEF45B8000-memory.dmpFilesize
160KB
-
memory/1452-40-0x000007FEF47E0000-0x000007FEF5890000-memory.dmpFilesize
16.7MB
-
memory/1452-61-0x000007FEF00B0000-0x000007FEF0230000-memory.dmpFilesize
1.5MB
-
memory/1452-62-0x000007FEF1A10000-0x000007FEF1A27000-memory.dmpFilesize
92KB
-
memory/1452-63-0x000007FEEF430000-0x000007FEEF441000-memory.dmpFilesize
68KB
-
memory/1452-64-0x000007FEEF1E0000-0x000007FEEF237000-memory.dmpFilesize
348KB
-
memory/1452-65-0x000007FEEF1B0000-0x000007FEEF1DF000-memory.dmpFilesize
188KB
-
memory/1452-66-0x000007FEEF190000-0x000007FEEF1A3000-memory.dmpFilesize
76KB
-
memory/1452-67-0x000007FEEF170000-0x000007FEEF181000-memory.dmpFilesize
68KB
-
memory/1452-68-0x000007FEEF0A0000-0x000007FEEF165000-memory.dmpFilesize
788KB
-
memory/1452-69-0x000007FEEF080000-0x000007FEEF093000-memory.dmpFilesize
76KB
-
memory/1452-70-0x000007FEEF060000-0x000007FEEF071000-memory.dmpFilesize
68KB
-
memory/1452-71-0x000007FEEF040000-0x000007FEEF054000-memory.dmpFilesize
80KB
-
memory/1452-72-0x000007FEEF020000-0x000007FEEF032000-memory.dmpFilesize
72KB
-
memory/1452-73-0x000007FEEF000000-0x000007FEEF014000-memory.dmpFilesize
80KB
-
memory/1452-74-0x000007FEEEFE0000-0x000007FEEEFFE000-memory.dmpFilesize
120KB
-
memory/1452-75-0x000007FEEEFC0000-0x000007FEEEFD7000-memory.dmpFilesize
92KB