Analysis

  • max time kernel
    143s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25-05-2024 12:57

General

  • Target

    CraxsRat 3.9.2.rar

  • Size

    335.5MB

  • MD5

    ea8c95aec54968aa5358790411e37e6d

  • SHA1

    05510fea19888a114801a160ba7771229b2afb71

  • SHA256

    e37a2e844d1e25a064d475442d514b020e9950c465beee965df45f4e0f445c60

  • SHA512

    1f30339aa05641746c102d5810a21c6633eae3966d3802d4d44090edc3f51cc9b9d917ddcd5688a537a8d714d37f37bc5293fcf15f250de93536576edca17436

  • SSDEEP

    6291456:/9vuWlbABKecinWAsHQcwSsMykkRm0yP8SkyykkRm0yP8SkO:/9G4sKo0HvwSvd78Cd78W

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\CraxsRat 3.9.2.rar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CraxsRat 3.9.2.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CraxsRat 3.9.2.rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2516
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\CraxsRat 3.9.2.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2700-30-0x000007FEFB1A0000-0x000007FEFB1D4000-memory.dmp

    Filesize

    208KB

  • memory/2700-29-0x000000013FB60000-0x000000013FC58000-memory.dmp

    Filesize

    992KB

  • memory/2700-32-0x000007FEFB180000-0x000007FEFB198000-memory.dmp

    Filesize

    96KB

  • memory/2700-33-0x000007FEFB160000-0x000007FEFB177000-memory.dmp

    Filesize

    92KB

  • memory/2700-31-0x000007FEF61C0000-0x000007FEF6476000-memory.dmp

    Filesize

    2.7MB

  • memory/2700-35-0x000007FEF7D80000-0x000007FEF7D97000-memory.dmp

    Filesize

    92KB

  • memory/2700-34-0x000007FEFB140000-0x000007FEFB151000-memory.dmp

    Filesize

    68KB

  • memory/2700-38-0x000007FEF6F70000-0x000007FEF6F81000-memory.dmp

    Filesize

    68KB

  • memory/2700-37-0x000007FEF7AF0000-0x000007FEF7B0D000-memory.dmp

    Filesize

    116KB

  • memory/2700-36-0x000007FEF7B10000-0x000007FEF7B21000-memory.dmp

    Filesize

    68KB

  • memory/2700-39-0x000007FEF5C50000-0x000007FEF5E5B000-memory.dmp

    Filesize

    2.0MB

  • memory/2700-42-0x000007FEF6980000-0x000007FEF69A1000-memory.dmp

    Filesize

    132KB

  • memory/2700-41-0x000007FEF6AF0000-0x000007FEF6B31000-memory.dmp

    Filesize

    260KB

  • memory/2700-45-0x000007FEF5C10000-0x000007FEF5C21000-memory.dmp

    Filesize

    68KB

  • memory/2700-46-0x000007FEF5BF0000-0x000007FEF5C01000-memory.dmp

    Filesize

    68KB

  • memory/2700-44-0x000007FEF5C30000-0x000007FEF5C41000-memory.dmp

    Filesize

    68KB

  • memory/2700-43-0x000007FEF6AD0000-0x000007FEF6AE8000-memory.dmp

    Filesize

    96KB

  • memory/2700-47-0x000007FEF5BD0000-0x000007FEF5BEB000-memory.dmp

    Filesize

    108KB

  • memory/2700-48-0x000007FEF5BB0000-0x000007FEF5BC1000-memory.dmp

    Filesize

    68KB

  • memory/2700-49-0x000007FEF5B90000-0x000007FEF5BA8000-memory.dmp

    Filesize

    96KB

  • memory/2700-51-0x000007FEF5AF0000-0x000007FEF5B57000-memory.dmp

    Filesize

    412KB

  • memory/2700-50-0x000007FEF5B60000-0x000007FEF5B90000-memory.dmp

    Filesize

    192KB

  • memory/2700-52-0x000007FEF5A70000-0x000007FEF5AEC000-memory.dmp

    Filesize

    496KB

  • memory/2700-53-0x000007FEF5A50000-0x000007FEF5A61000-memory.dmp

    Filesize

    68KB

  • memory/2700-54-0x000007FEF59F0000-0x000007FEF5A47000-memory.dmp

    Filesize

    348KB

  • memory/2700-56-0x000007FEF5990000-0x000007FEF59B4000-memory.dmp

    Filesize

    144KB

  • memory/2700-55-0x000007FEF59C0000-0x000007FEF59E8000-memory.dmp

    Filesize

    160KB

  • memory/2700-59-0x000007FEF5920000-0x000007FEF5931000-memory.dmp

    Filesize

    68KB

  • memory/2700-40-0x000007FEF4590000-0x000007FEF5640000-memory.dmp

    Filesize

    16.7MB

  • memory/2700-62-0x000007FEF3B20000-0x000007FEF3C1F000-memory.dmp

    Filesize

    1020KB

  • memory/2700-63-0x000007FEF1EC0000-0x000007FEF1ED1000-memory.dmp

    Filesize

    68KB

  • memory/2700-61-0x000007FEF3C20000-0x000007FEF3C31000-memory.dmp

    Filesize

    68KB

  • memory/2700-60-0x000007FEF5900000-0x000007FEF5912000-memory.dmp

    Filesize

    72KB

  • memory/2700-58-0x000007FEF5940000-0x000007FEF5963000-memory.dmp

    Filesize

    140KB

  • memory/2700-57-0x000007FEF5970000-0x000007FEF5988000-memory.dmp

    Filesize

    96KB

  • memory/2700-64-0x000007FEF1E60000-0x000007FEF1EB7000-memory.dmp

    Filesize

    348KB

  • memory/2700-65-0x000007FEF1A60000-0x000007FEF1A8F000-memory.dmp

    Filesize

    188KB

  • memory/2700-66-0x000007FEF1A40000-0x000007FEF1A53000-memory.dmp

    Filesize

    76KB

  • memory/2700-67-0x000007FEF1A20000-0x000007FEF1A31000-memory.dmp

    Filesize

    68KB

  • memory/2700-68-0x000007FEF01C0000-0x000007FEF0285000-memory.dmp

    Filesize

    788KB

  • memory/2700-69-0x000007FEF1A00000-0x000007FEF1A13000-memory.dmp

    Filesize

    76KB

  • memory/2700-70-0x000007FEF19E0000-0x000007FEF19F1000-memory.dmp

    Filesize

    68KB

  • memory/2700-71-0x000007FEF01A0000-0x000007FEF01B4000-memory.dmp

    Filesize

    80KB

  • memory/2700-73-0x000007FEF0110000-0x000007FEF0122000-memory.dmp

    Filesize

    72KB

  • memory/2700-72-0x000007FEEF630000-0x000007FEEF836000-memory.dmp

    Filesize

    2.0MB

  • memory/2700-74-0x000007FEF0070000-0x000007FEF00B2000-memory.dmp

    Filesize

    264KB

  • memory/2700-75-0x000007FEEFF00000-0x000007FEEFF4D000-memory.dmp

    Filesize

    308KB