dcrat | 1eb23606ac29d2eb83bb2ecef63d8258e734d277a69627ea3c349458fc240389

Analysis

max time kernel
156s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/09/2022, 11:29

Target
sdfafdsg.exe
Size 1012KB
Sample220910-nlkgaaaae8
SHA256 1eb23606ac29d2eb83bb2ecef63d8258e734d277a69627ea3c349458fc240389
MD5 576b4a5b9b46b855743cfba07b455756
SHA1 2072dbed8d16aba233dc00df32038766de821977
SHA512 eee2f3fdb04f7402b20717cfb9de40d0460bc163ca8158e869e0c2c9aae886cd9dd8956d08d2700051aaf21351f851c76a6c733220fd8a1a40181f54882d98ec
SSDEEP 12288:iMZxtBm9GqBK4uwXL99Gwyo81r5QpSrjAF7LQ2N+4C6xnetB+cdyaMvFLitk3h5r:iuxT4BrL7Gwyfuoj47zMbeFLVxJH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
behavioral2/memory/101636-133-0x0000000000900000-0x00000000009B6000-memory.dmp	dcrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 101636	2064	sdfafdsg.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
101816	2064	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
101636	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	101636	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 101636	2064	sdfafdsg.exe	85
PID 2064 wrote to memory of 101636	2064	sdfafdsg.exe	85
PID 2064 wrote to memory of 101636	2064	sdfafdsg.exe	85
PID 2064 wrote to memory of 101636	2064	sdfafdsg.exe	85
PID 2064 wrote to memory of 101636	2064	sdfafdsg.exe	85

C:\Users\Admin\AppData\Local\Temp\sdfafdsg.exe
"C:\Users\Admin\AppData\Local\Temp\sdfafdsg.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:101636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 98428
  2⤵
  - Program crash
  PID:101816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2064 -ip 2064
1⤵
PID:101680

memory/101636-133-0x0000000000900000-0x00000000009B6000-memory.dmp

Download

memory/101636-138-0x0000000005B50000-0x00000000060F4000-memory.dmp

Download

memory/101636-139-0x00000000058C0000-0x0000000005910000-memory.dmp

Download

memory/101636-140-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Download

memory/101636-141-0x00000000068E0000-0x0000000006972000-memory.dmp

Download