Analysis
-
max time kernel
1794s -
max time network
1568s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 15:37
Behavioral task
behavioral1
Sample
Craxsrat V4.9.5 Cleaned Version.rar
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Craxsrat V4.9.5 Cleaned Version.rar
Resource
win7-20240419-en
Behavioral task
behavioral3
Sample
Craxsrat V4.9.5 Cleaned Version.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
Craxsrat V4.9.5 Cleaned Version.rar
Resource
win11-20240426-en
General
-
Target
Craxsrat V4.9.5 Cleaned Version.rar
-
Size
202.2MB
-
MD5
a22a3f53b4f3ac6cd04d62adfbb481a7
-
SHA1
f5366c4e387c09a80420c88f6e275c66382ed2ce
-
SHA256
f899a5ca771d41fbdfa9b90ba41ca7112bb4791b3dbb2470d380f490727ad010
-
SHA512
a527daf05eda8ffa6ea984699b286dda0b13daaade14bec43018020633c9a27b98bb32c2c2bc54e4751f9cb054c4f3c01878555ca9ff15a4c688bf65f31626ad
-
SSDEEP
3145728:mF6sOfXErUkpM/PYWsS9vZT25OH5kN4NQ908t24lZT25OZbU3Io8SkLMFG:4UXnke/wvuykkRm0yP8SkQFG
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
rundll32.exerundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 1732 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 1732 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
vlc.exepid process 1732 vlc.exe 1732 vlc.exe 1732 vlc.exe 1732 vlc.exe 1732 vlc.exe 1732 vlc.exe 1732 vlc.exe 1732 vlc.exe 1732 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
vlc.exepid process 1732 vlc.exe 1732 vlc.exe 1732 vlc.exe 1732 vlc.exe 1732 vlc.exe 1732 vlc.exe 1732 vlc.exe 1732 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 1732 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exerundll32.exerundll32.exedescription pid process target process PID 3020 wrote to memory of 2676 3020 cmd.exe rundll32.exe PID 3020 wrote to memory of 2676 3020 cmd.exe rundll32.exe PID 3020 wrote to memory of 2676 3020 cmd.exe rundll32.exe PID 2676 wrote to memory of 2580 2676 rundll32.exe rundll32.exe PID 2676 wrote to memory of 2580 2676 rundll32.exe rundll32.exe PID 2676 wrote to memory of 2580 2676 rundll32.exe rundll32.exe PID 2580 wrote to memory of 1732 2580 rundll32.exe vlc.exe PID 2580 wrote to memory of 1732 2580 rundll32.exe vlc.exe PID 2580 wrote to memory of 1732 2580 rundll32.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Craxsrat V4.9.5 Cleaned Version.rar"1⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Craxsrat V4.9.5 Cleaned Version.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Craxsrat V4.9.5 Cleaned Version.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Craxsrat V4.9.5 Cleaned Version.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1732-30-0x000007FEFA840000-0x000007FEFA874000-memory.dmpFilesize
208KB
-
memory/1732-29-0x000000013FA20000-0x000000013FB18000-memory.dmpFilesize
992KB
-
memory/1732-32-0x000007FEFA820000-0x000007FEFA838000-memory.dmpFilesize
96KB
-
memory/1732-33-0x000007FEFA800000-0x000007FEFA817000-memory.dmpFilesize
92KB
-
memory/1732-34-0x000007FEFA7E0000-0x000007FEFA7F1000-memory.dmpFilesize
68KB
-
memory/1732-35-0x000007FEFA7C0000-0x000007FEFA7D7000-memory.dmpFilesize
92KB
-
memory/1732-36-0x000007FEF7A90000-0x000007FEF7AA1000-memory.dmpFilesize
68KB
-
memory/1732-37-0x000007FEF7A70000-0x000007FEF7A8D000-memory.dmpFilesize
116KB
-
memory/1732-38-0x000007FEF7A50000-0x000007FEF7A61000-memory.dmpFilesize
68KB
-
memory/1732-31-0x000007FEF59C0000-0x000007FEF5C76000-memory.dmpFilesize
2.7MB
-
memory/1732-42-0x000007FEF6C70000-0x000007FEF6C91000-memory.dmpFilesize
132KB
-
memory/1732-44-0x000007FEF6C30000-0x000007FEF6C41000-memory.dmpFilesize
68KB
-
memory/1732-52-0x000007FEF5590000-0x000007FEF560C000-memory.dmpFilesize
496KB
-
memory/1732-40-0x000007FEF5680000-0x000007FEF588B000-memory.dmpFilesize
2.0MB
-
memory/1732-41-0x000007FEF6CA0000-0x000007FEF6CE1000-memory.dmpFilesize
260KB
-
memory/1732-45-0x000007FEF60E0000-0x000007FEF60F1000-memory.dmpFilesize
68KB
-
memory/1732-48-0x000007FEF6080000-0x000007FEF6091000-memory.dmpFilesize
68KB
-
memory/1732-50-0x000007FEF6030000-0x000007FEF6060000-memory.dmpFilesize
192KB
-
memory/1732-51-0x000007FEF5610000-0x000007FEF5677000-memory.dmpFilesize
412KB
-
memory/1732-54-0x000007FEF5530000-0x000007FEF5587000-memory.dmpFilesize
348KB
-
memory/1732-58-0x000007FEF54A0000-0x000007FEF54C3000-memory.dmpFilesize
140KB
-
memory/1732-65-0x000007FEF22A0000-0x000007FEF22B1000-memory.dmpFilesize
68KB
-
memory/1732-64-0x000007FEF22C0000-0x000007FEF22D3000-memory.dmpFilesize
76KB
-
memory/1732-63-0x000007FEF22E0000-0x000007FEF230F000-memory.dmpFilesize
188KB
-
memory/1732-62-0x000007FEF2310000-0x000007FEF2367000-memory.dmpFilesize
348KB
-
memory/1732-61-0x000007FEF2370000-0x000007FEF2381000-memory.dmpFilesize
68KB
-
memory/1732-60-0x000007FEF5460000-0x000007FEF5472000-memory.dmpFilesize
72KB
-
memory/1732-66-0x000007FEF21D0000-0x000007FEF2295000-memory.dmpFilesize
788KB
-
memory/1732-69-0x000007FEF2170000-0x000007FEF2184000-memory.dmpFilesize
80KB
-
memory/1732-68-0x000007FEF2190000-0x000007FEF21A1000-memory.dmpFilesize
68KB
-
memory/1732-67-0x000007FEF21B0000-0x000007FEF21C3000-memory.dmpFilesize
76KB
-
memory/1732-59-0x000007FEF5480000-0x000007FEF5491000-memory.dmpFilesize
68KB
-
memory/1732-57-0x000007FEF5FF0000-0x000007FEF6008000-memory.dmpFilesize
96KB
-
memory/1732-56-0x000007FEF54D0000-0x000007FEF54F4000-memory.dmpFilesize
144KB
-
memory/1732-55-0x000007FEF5500000-0x000007FEF5528000-memory.dmpFilesize
160KB
-
memory/1732-53-0x000007FEF6010000-0x000007FEF6021000-memory.dmpFilesize
68KB
-
memory/1732-49-0x000007FEF6060000-0x000007FEF6078000-memory.dmpFilesize
96KB
-
memory/1732-47-0x000007FEF60A0000-0x000007FEF60BB000-memory.dmpFilesize
108KB
-
memory/1732-46-0x000007FEF60C0000-0x000007FEF60D1000-memory.dmpFilesize
68KB
-
memory/1732-43-0x000007FEF6C50000-0x000007FEF6C68000-memory.dmpFilesize
96KB
-
memory/1732-39-0x000007FEF3DE0000-0x000007FEF4E90000-memory.dmpFilesize
16.7MB
-
memory/1732-73-0x000007FEF1EA0000-0x000007FEF1EED000-memory.dmpFilesize
308KB
-
memory/1732-72-0x000007FEF1EF0000-0x000007FEF1F32000-memory.dmpFilesize
264KB
-
memory/1732-71-0x000007FEF1F40000-0x000007FEF1F52000-memory.dmpFilesize
72KB
-
memory/1732-70-0x000007FEF1F60000-0x000007FEF2166000-memory.dmpFilesize
2.0MB