Overview
overview
7Static
static
7CraxsRat V7.zip
windows7-x64
1CraxsRat V7.zip
windows10-2004-x64
1CraxsRat V...g.html
windows7-x64
3CraxsRat V...g.html
windows10-2004-x64
3CraxsRat V...g.json
windows7-x64
3CraxsRat V...g.json
windows10-2004-x64
3CraxsRat V...at.exe
windows7-x64
1CraxsRat V...at.exe
windows10-2004-x64
3CraxsRat V...xe.xml
windows7-x64
3CraxsRat V...xe.xml
windows10-2004-x64
1CraxsRat V...rk.dll
windows7-x64
1CraxsRat V...rk.dll
windows10-2004-x64
1CraxsRat V...ys.dll
windows7-x64
1CraxsRat V...ys.dll
windows10-2004-x64
1CraxsRat V...64.dll
windows7-x64
1CraxsRat V...64.dll
windows10-2004-x64
1CraxsRat V...tm.dll
windows7-x64
3CraxsRat V...tm.dll
windows10-2004-x64
3CraxsRat V...PS.dll
windows7-x64
1CraxsRat V...PS.dll
windows10-2004-x64
1CraxsRat V...ms.dll
windows7-x64
1CraxsRat V...ms.dll
windows10-2004-x64
1CraxsRat V...ms.pdb
windows7-x64
3CraxsRat V...ms.pdb
windows10-2004-x64
3CraxsRat V...ms.xml
windows7-x64
3CraxsRat V...ms.xml
windows10-2004-x64
1CraxsRat V...pf.dll
windows7-x64
1CraxsRat V...pf.dll
windows10-2004-x64
1CraxsRat V...pf.pdb
windows7-x64
3CraxsRat V...pf.pdb
windows10-2004-x64
3CraxsRat V...pf.xml
windows7-x64
3CraxsRat V...pf.xml
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01-09-2024 16:31
Behavioral task
behavioral1
Sample
CraxsRat V7.zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
CraxsRat V7.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
CraxsRat V7/ChangeLog.html
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
CraxsRat V7/ChangeLog.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
CraxsRat V7/Config.json
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
CraxsRat V7/Config.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
CraxsRat V7/CraxsRat.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
CraxsRat V7/CraxsRat.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
CraxsRat V7/CraxsRat.exe.xml
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
CraxsRat V7/CraxsRat.exe.xml
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
CraxsRat V7/DrakeUI.Framework.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
CraxsRat V7/DrakeUI.Framework.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
CraxsRat V7/GeoIPCitys.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
CraxsRat V7/GeoIPCitys.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
CraxsRat V7/HVMRun64.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
CraxsRat V7/HVMRun64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
CraxsRat V7/HVMRuntm.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
CraxsRat V7/HVMRuntm.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
CraxsRat V7/LiveCharts.MAPS.dll
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
CraxsRat V7/LiveCharts.MAPS.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
CraxsRat V7/LiveCharts.WinForms.dll
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
CraxsRat V7/LiveCharts.WinForms.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
CraxsRat V7/LiveCharts.WinForms.pdb
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
CraxsRat V7/LiveCharts.WinForms.pdb
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
CraxsRat V7/LiveCharts.WinForms.xml
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
CraxsRat V7/LiveCharts.WinForms.xml
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
CraxsRat V7/LiveCharts.Wpf.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
CraxsRat V7/LiveCharts.Wpf.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
CraxsRat V7/LiveCharts.Wpf.pdb
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
CraxsRat V7/LiveCharts.Wpf.pdb
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
CraxsRat V7/LiveCharts.Wpf.xml
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
CraxsRat V7/LiveCharts.Wpf.xml
Resource
win10v2004-20240802-en
General
-
Target
CraxsRat V7/LiveCharts.WinForms.pdb
-
Size
67KB
-
MD5
75ac1d35a79db3ed5810097bacd498ff
-
SHA1
d8e4fa365f129e5eb07ba46167af44640e35bb14
-
SHA256
26021aa51eab1b7e82efc702ef39dc6180f144415bc0a14ccace060dad555c77
-
SHA512
6bf9b14ddee3304460db5f5d30d621e6703992fa05397f56fbc6fae426d953057bc948934a4e593ceedc61a55e4c87724c566e55a3ea3e025da0dd00f0ea6ffa
-
SSDEEP
768:hT9G+kghBFt1dQLQ5hgoClMn2a4HMag2krNts4:d9G5gBtzQLQj+1VVkrA4
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.pdb rundll32.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pdb_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.pdb\ = "pdb_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pdb_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pdb_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pdb_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pdb_auto_file\ rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2728 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2728 AcroRd32.exe 2728 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2212 wrote to memory of 2416 2212 cmd.exe rundll32.exe PID 2212 wrote to memory of 2416 2212 cmd.exe rundll32.exe PID 2212 wrote to memory of 2416 2212 cmd.exe rundll32.exe PID 2416 wrote to memory of 2728 2416 rundll32.exe AcroRd32.exe PID 2416 wrote to memory of 2728 2416 rundll32.exe AcroRd32.exe PID 2416 wrote to memory of 2728 2416 rundll32.exe AcroRd32.exe PID 2416 wrote to memory of 2728 2416 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\CraxsRat V7\LiveCharts.WinForms.pdb"1⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CraxsRat V7\LiveCharts.WinForms.pdb2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CraxsRat V7\LiveCharts.WinForms.pdb"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2728
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58c299e6655c1dab3abed6a7a3582235b
SHA1076ffc560b2d5ee166e198b4d95f3a921b5d8168
SHA256ffcafec2c68fdc019daa40321503ef361b1db8ad73a5332a25d21aa59819eda2
SHA512a13f2fb84ae28f85307162209c960bfd2b8ff100e5719d6caab8a466d018b20f3e13bae4b69261e8cbe96533534da7d88792ca84ec0f2b420be19426ebfb1a43