Overview
overview
7Static
static
7CraxsRat V7.zip
windows7-x64
1CraxsRat V7.zip
windows10-2004-x64
1CraxsRat V...g.html
windows7-x64
3CraxsRat V...g.html
windows10-2004-x64
3CraxsRat V...g.json
windows7-x64
3CraxsRat V...g.json
windows10-2004-x64
3CraxsRat V...at.exe
windows7-x64
1CraxsRat V...at.exe
windows10-2004-x64
3CraxsRat V...xe.xml
windows7-x64
3CraxsRat V...xe.xml
windows10-2004-x64
1CraxsRat V...rk.dll
windows7-x64
1CraxsRat V...rk.dll
windows10-2004-x64
1CraxsRat V...ys.dll
windows7-x64
1CraxsRat V...ys.dll
windows10-2004-x64
1CraxsRat V...64.dll
windows7-x64
1CraxsRat V...64.dll
windows10-2004-x64
1CraxsRat V...tm.dll
windows7-x64
3CraxsRat V...tm.dll
windows10-2004-x64
3CraxsRat V...PS.dll
windows7-x64
1CraxsRat V...PS.dll
windows10-2004-x64
1CraxsRat V...ms.dll
windows7-x64
1CraxsRat V...ms.dll
windows10-2004-x64
1CraxsRat V...ms.pdb
windows7-x64
3CraxsRat V...ms.pdb
windows10-2004-x64
3CraxsRat V...ms.xml
windows7-x64
3CraxsRat V...ms.xml
windows10-2004-x64
1CraxsRat V...pf.dll
windows7-x64
1CraxsRat V...pf.dll
windows10-2004-x64
1CraxsRat V...pf.pdb
windows7-x64
3CraxsRat V...pf.pdb
windows10-2004-x64
3CraxsRat V...pf.xml
windows7-x64
3CraxsRat V...pf.xml
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01-09-2024 16:31
Behavioral task
behavioral1
Sample
CraxsRat V7.zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
CraxsRat V7.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
CraxsRat V7/ChangeLog.html
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
CraxsRat V7/ChangeLog.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
CraxsRat V7/Config.json
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
CraxsRat V7/Config.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
CraxsRat V7/CraxsRat.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
CraxsRat V7/CraxsRat.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
CraxsRat V7/CraxsRat.exe.xml
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
CraxsRat V7/CraxsRat.exe.xml
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
CraxsRat V7/DrakeUI.Framework.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
CraxsRat V7/DrakeUI.Framework.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
CraxsRat V7/GeoIPCitys.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
CraxsRat V7/GeoIPCitys.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
CraxsRat V7/HVMRun64.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
CraxsRat V7/HVMRun64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
CraxsRat V7/HVMRuntm.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
CraxsRat V7/HVMRuntm.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
CraxsRat V7/LiveCharts.MAPS.dll
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
CraxsRat V7/LiveCharts.MAPS.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
CraxsRat V7/LiveCharts.WinForms.dll
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
CraxsRat V7/LiveCharts.WinForms.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
CraxsRat V7/LiveCharts.WinForms.pdb
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
CraxsRat V7/LiveCharts.WinForms.pdb
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
CraxsRat V7/LiveCharts.WinForms.xml
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
CraxsRat V7/LiveCharts.WinForms.xml
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
CraxsRat V7/LiveCharts.Wpf.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
CraxsRat V7/LiveCharts.Wpf.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
CraxsRat V7/LiveCharts.Wpf.pdb
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
CraxsRat V7/LiveCharts.Wpf.pdb
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
CraxsRat V7/LiveCharts.Wpf.xml
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
CraxsRat V7/LiveCharts.Wpf.xml
Resource
win10v2004-20240802-en
General
-
Target
CraxsRat V7/LiveCharts.Wpf.pdb
-
Size
487KB
-
MD5
f209a4302b929a36dd534dc48dfdc617
-
SHA1
58eb81643b8b1218acdbef4f8f1ba7e1fa5df666
-
SHA256
718ff471c7ccfa31e9cf905dfa01c9925d692835ea646e95754fd801a5ee4ca8
-
SHA512
fa8f86dc1701c7ad639c7f49ad314376a64bb5e3c3d4d3820af35c39e5224b6a933f7db6f0ead695ea13196cd2cd14f96c60705be72404c24d0bd2b9ee838600
-
SSDEEP
6144:fvskjr4dN4VUxH/vHhHi5vWtah65yZwxrg7NEXPsBlAkrRB3WRS:wW+FxbfsBlAk
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pdb_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.pdb rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.pdb\ = "pdb_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pdb_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pdb_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pdb_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pdb_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2640 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2640 AcroRd32.exe 2640 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2072 wrote to memory of 2116 2072 cmd.exe rundll32.exe PID 2072 wrote to memory of 2116 2072 cmd.exe rundll32.exe PID 2072 wrote to memory of 2116 2072 cmd.exe rundll32.exe PID 2116 wrote to memory of 2640 2116 rundll32.exe AcroRd32.exe PID 2116 wrote to memory of 2640 2116 rundll32.exe AcroRd32.exe PID 2116 wrote to memory of 2640 2116 rundll32.exe AcroRd32.exe PID 2116 wrote to memory of 2640 2116 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\CraxsRat V7\LiveCharts.Wpf.pdb"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CraxsRat V7\LiveCharts.Wpf.pdb2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CraxsRat V7\LiveCharts.Wpf.pdb"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2640
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD595958f681e216acb215d032a5778267a
SHA1889106bfbf84337d70fbb9bbe3fc4b7a02d579f1
SHA256a6919ab4a40e456e7cf9ad453cf7a512d7d23e286b2f74469f98d3256bb1ad7e
SHA512166e34ed214e1b51f71f915594414f74c2d851fce0c6fa38404917cad9f056ddeeaa2799f34da7b638e7db7e5bd20ff5c05940bc3817ad49f98604a06a71c19a