Analysis

  • max time kernel
    147s
  • max time network
    160s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29-11-2024 17:58

General

  • Target

    CraxsRat v7.6‌‌‌/CraxsRat v7.6‌‌‌.exe

  • Size

    65.1MB

  • MD5

    272f7334e633d81757417aca3f7b9890

  • SHA1

    290030d91d98910ee5674e0efd2c2af055a2c3da

  • SHA256

    9c7b489b5139074e2fa6088e042a13eecaf781f0b7ff6d62c244159dc39c1f8c

  • SHA512

    2540812d4870140805741eb46fd8059a53958bcc84878e5059046687633f59a85b67137ac5c40e07624046c2f7289506f700d4fd2c181b1f69f2738661f2e46c

  • SSDEEP

    1572864:jmwRxPP7VydDyyFwjXsw8r8yosihxNcfDEvpTUWE8prCiSY:KwRxX8dyyFcsbohYfsprE8pHSY

Malware Config

Extracted

Family

xworm

C2

146.190.110.91:3389

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    taskhostw.exe

  • telegram

    https://api.telegram.org/bot7825054734:AAGZqFAN8E4lv2mzGaChvBqZKYsgV2POVt4/sendMessage?chat_id=6801210841

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Themida packer 11 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 63 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CraxsRat v7.6‌‌‌\CraxsRat v7.6‌‌‌.exe
    "C:\Users\Admin\AppData\Local\Temp\CraxsRat v7.6‌‌‌\CraxsRat v7.6‌‌‌.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Users\Admin\AppData\Local\Temp\CraxsRat v7.6‌‌‌\CraxsRat v7.6.exe
      "C:\Users\Admin\AppData\Local\Temp\CraxsRat v7.6‌‌‌\CraxsRat v7.6.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1992
    • C:\Users\Admin\AppData\Roaming\taskhostw.exe
      "C:\Users\Admin\AppData\Roaming\taskhostw.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\taskhostw.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2636
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskhostw.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1140
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\taskhostw.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2920
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskhostw.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2184
    • C:\ProgramData\svchost.exe
      "C:\ProgramData\svchost.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2080
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Windows Services'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1616
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /create /tn svchost.exe /tr "C:\Users\Admin\AppData\Local\Windows Services\svchost.exe" /st 18:07 /du 23:59 /sc daily /ri 1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1176
      • C:\Users\Admin\AppData\Local\Windows Services\svchost.exe
        "C:\Users\Admin\AppData\Local\Windows Services\svchost.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        PID:1900
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp4EDB.tmp.cmd""
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1844
        • C:\Windows\SysWOW64\timeout.exe
          timeout 6
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:1792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp4EDB.tmp.cmd

    Filesize

    140B

    MD5

    082eb9cb1a0fe3a65e9a0bf147859945

    SHA1

    8a6422e683bdf4365e8dd780e62dea3af10e6d92

    SHA256

    8d45534dc5e11037e91be6faac113b5423a521bae8f92ba39fbc2d42c8f8bb68

    SHA512

    b7084120e370f1369b8757c468abd90eefa85bedca1316b8bed38fa7ab46cb50a0de167c3b18751253a0548ba293af30e762aaf3fb5d7fc26715834833918e85

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    a428e546834eb1c3d36682a0ab4e9dc0

    SHA1

    9aeb00af87356b48c3dad0ad463a1dd231189736

    SHA256

    53b18b5f0451d67ca8a404313097176d33d444219d49e81b10ccb1cb097b9f6c

    SHA512

    7e57824b1fc799b8cc22f0ec09f55bbd57047aa415ea52756c53094eb0fecdb51a86eed44863c5f892227bbf5cc8180c556ef6241404a83a157c8dcbf15f001b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    89b33381ab132b18bba758b70286b434

    SHA1

    0a187d27bfd8b97ceff453096f884952039f7f76

    SHA256

    d9be24201d458da05bbcaa2185fcaa9d0d4e4d2b425387e875ae361ab2f892c9

    SHA512

    73a185d9cc9f9011300e5811f4d3fd9178441097b8cc3df4a60c3c35ad0e17f42604a57c959098cffee7a1c164d46dae14cce26b8a5b729215873e7bc591bdc4

  • C:\Users\Admin\AppData\Roaming\taskhostw.exe

    Filesize

    88KB

    MD5

    76b4f4d2ad4330e68394c65e6799036e

    SHA1

    2fa1d543314f6bb1223fbab3f13e8ace6350530c

    SHA256

    6ec688d3a682ce3eee578703b7283cfec7af9bbd901cc40c1574104a2ba7b27f

    SHA512

    f330c8edf20c429cba0eef521e9f44da7d93f3aa057aa5b278a8cf9af0f9f06a7e0beba5c141125ff7a3732ccd465845b6f1e5325f0704dbedf63f04a51d577f

  • \Users\Admin\AppData\Local\Temp\DN0000000066B686F0\Runtime64.dll

    Filesize

    9.4MB

    MD5

    1536bbb84ce32cfcaf72dbcfd5949401

    SHA1

    1c6742ed78c708672e06f2c8a4c989bc5e5a838d

    SHA256

    e3bcb8faecc22a443d41312b80e798a6358749d8b266a1bfc66ede45009e7b92

    SHA512

    387dda2304d0da1ed732c3d4a8f49987e5998251634cd8b449dd4821a0f7834830d7caaea5a0616ed5810ac4595d8355645266856cc8ba1e4bfed50c874c755e

  • memory/1140-60-0x0000000002A60000-0x0000000002A68000-memory.dmp

    Filesize

    32KB

  • memory/1140-59-0x000000001B570000-0x000000001B852000-memory.dmp

    Filesize

    2.9MB

  • memory/1900-114-0x0000000000BE0000-0x0000000000BF8000-memory.dmp

    Filesize

    96KB

  • memory/1992-27-0x0000000180000000-0x0000000181261000-memory.dmp

    Filesize

    18.4MB

  • memory/1992-98-0x0000000006940000-0x000000000694A000-memory.dmp

    Filesize

    40KB

  • memory/1992-25-0x0000000180000000-0x0000000181261000-memory.dmp

    Filesize

    18.4MB

  • memory/1992-24-0x0000000180000000-0x0000000181261000-memory.dmp

    Filesize

    18.4MB

  • memory/1992-28-0x000007FEF4BA0000-0x000007FEF4CCC000-memory.dmp

    Filesize

    1.2MB

  • memory/1992-29-0x00000000200E0000-0x000000002115C000-memory.dmp

    Filesize

    16.5MB

  • memory/1992-30-0x0000000021280000-0x000000002136A000-memory.dmp

    Filesize

    936KB

  • memory/1992-92-0x000000001F0C0000-0x000000001F0FE000-memory.dmp

    Filesize

    248KB

  • memory/1992-36-0x00000000068F0000-0x00000000068F6000-memory.dmp

    Filesize

    24KB

  • memory/1992-43-0x0000000006900000-0x0000000006906000-memory.dmp

    Filesize

    24KB

  • memory/1992-22-0x000007FFFFD50000-0x000007FFFFEF7000-memory.dmp

    Filesize

    1.7MB

  • memory/1992-50-0x000007FE96B40000-0x000007FE96B50000-memory.dmp

    Filesize

    64KB

  • memory/1992-49-0x000007FE96B40000-0x000007FE96B50000-memory.dmp

    Filesize

    64KB

  • memory/1992-99-0x0000000180000000-0x0000000181261000-memory.dmp

    Filesize

    18.4MB

  • memory/1992-52-0x0000000180000000-0x0000000181261000-memory.dmp

    Filesize

    18.4MB

  • memory/1992-26-0x0000000180000000-0x0000000181261000-memory.dmp

    Filesize

    18.4MB

  • memory/1992-21-0x0000000180000000-0x0000000181261000-memory.dmp

    Filesize

    18.4MB

  • memory/1992-16-0x0000000000A40000-0x00000000054D2000-memory.dmp

    Filesize

    74.6MB

  • memory/1992-117-0x000000001FB80000-0x000000001FBB6000-memory.dmp

    Filesize

    216KB

  • memory/1992-145-0x0000000180000000-0x0000000181261000-memory.dmp

    Filesize

    18.4MB

  • memory/1992-146-0x0000000033A00000-0x0000000033A10000-memory.dmp

    Filesize

    64KB

  • memory/1992-67-0x0000000180000000-0x0000000181261000-memory.dmp

    Filesize

    18.4MB

  • memory/1992-73-0x0000000006920000-0x000000000692C000-memory.dmp

    Filesize

    48KB

  • memory/1992-74-0x0000000006AE0000-0x0000000006B0C000-memory.dmp

    Filesize

    176KB

  • memory/1992-75-0x0000000006BF0000-0x0000000006C2C000-memory.dmp

    Filesize

    240KB

  • memory/1992-76-0x0000000006940000-0x000000000694A000-memory.dmp

    Filesize

    40KB

  • memory/1992-97-0x0000000180000000-0x0000000181261000-memory.dmp

    Filesize

    18.4MB

  • memory/1992-93-0x0000000006940000-0x0000000006941000-memory.dmp

    Filesize

    4KB

  • memory/1992-91-0x0000000023970000-0x0000000023B16000-memory.dmp

    Filesize

    1.6MB

  • memory/2080-90-0x00000000003B0000-0x00000000003C8000-memory.dmp

    Filesize

    96KB

  • memory/2428-0-0x000007FEF6263000-0x000007FEF6264000-memory.dmp

    Filesize

    4KB

  • memory/2428-89-0x000007FEF6260000-0x000007FEF6C4C000-memory.dmp

    Filesize

    9.9MB

  • memory/2428-53-0x000007FEF6260000-0x000007FEF6C4C000-memory.dmp

    Filesize

    9.9MB

  • memory/2428-35-0x000007FEF6263000-0x000007FEF6264000-memory.dmp

    Filesize

    4KB

  • memory/2428-2-0x000007FEF6260000-0x000007FEF6C4C000-memory.dmp

    Filesize

    9.9MB

  • memory/2428-1-0x0000000000060000-0x0000000004176000-memory.dmp

    Filesize

    65.1MB

  • memory/2488-15-0x0000000000240000-0x000000000025C000-memory.dmp

    Filesize

    112KB

  • memory/2636-51-0x00000000028E0000-0x00000000028E8000-memory.dmp

    Filesize

    32KB

  • memory/2636-44-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

    Filesize

    2.9MB