Analysis
-
max time kernel
103s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
09-01-2023 14:41
General
-
Target
429b305d240c130b141eb3d4c0ba1fa731b4ba3fcfbebe3b3de0c329d947ed8c.exe
-
Size
2.0MB
-
MD5
5bc462a7ed28ccdf5afbcdbbe85d1b76
-
SHA1
9aea646d5ddb0c75294b2e8a61aa99b7003d0b56
-
SHA256
429b305d240c130b141eb3d4c0ba1fa731b4ba3fcfbebe3b3de0c329d947ed8c
-
SHA512
85de4e7f2bc6183a13c361a9b5d388fa42a5e653d62b1585444f55cac2717c5f6c0408bf2cbcc783c3b08b40dbc0cab940cbf57e2f0e58f3b5b8693ca1e82d2f
-
SSDEEP
49152:dndSiKG7Idc6Rm8sDJMSgkdEiVTpnjyv:dhURm8vSFVov
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\429b305d240c130b141eb3d4c0ba1fa731b4ba3fcfbebe3b3de0c329d947ed8c.exe"C:\Users\Admin\AppData\Local\Temp\429b305d240c130b141eb3d4c0ba1fa731b4ba3fcfbebe3b3de0c329d947ed8c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3968-132-0x0000000000DA0000-0x0000000000F9A000-memory.dmpFilesize
2.0MB
-
memory/3968-133-0x00007FF963CA0000-0x00007FF964761000-memory.dmpFilesize
10.8MB
-
memory/3968-134-0x00007FF963CA0000-0x00007FF964761000-memory.dmpFilesize
10.8MB