DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Modifies Windows Defender Real-time Protection settings

Modifies security service

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

UAC bypass

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

Downloads MZ/PE file

Executes dropped EXE