Analysis

  • max time kernel
    122s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01-09-2024 16:31

General

  • Target

    CraxsRat V7/LiveCharts.WinForms.pdb

  • Size

    67KB

  • MD5

    75ac1d35a79db3ed5810097bacd498ff

  • SHA1

    d8e4fa365f129e5eb07ba46167af44640e35bb14

  • SHA256

    26021aa51eab1b7e82efc702ef39dc6180f144415bc0a14ccace060dad555c77

  • SHA512

    6bf9b14ddee3304460db5f5d30d621e6703992fa05397f56fbc6fae426d953057bc948934a4e593ceedc61a55e4c87724c566e55a3ea3e025da0dd00f0ea6ffa

  • SSDEEP

    768:hT9G+kghBFt1dQLQ5hgoClMn2a4HMag2krNts4:d9G5gBtzQLQj+1VVkrA4

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\CraxsRat V7\LiveCharts.WinForms.pdb"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CraxsRat V7\LiveCharts.WinForms.pdb
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CraxsRat V7\LiveCharts.WinForms.pdb"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    8c299e6655c1dab3abed6a7a3582235b

    SHA1

    076ffc560b2d5ee166e198b4d95f3a921b5d8168

    SHA256

    ffcafec2c68fdc019daa40321503ef361b1db8ad73a5332a25d21aa59819eda2

    SHA512

    a13f2fb84ae28f85307162209c960bfd2b8ff100e5719d6caab8a466d018b20f3e13bae4b69261e8cbe96533534da7d88792ca84ec0f2b420be19426ebfb1a43