dcrat | dfc9ecd681ac21c94bae46bb1f511b2b1c3897296abf84cc1b33d6ccbee86fae

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
10-01-2023 06:36

Target

c5598feb9aa8270fde3defea2a203a76.exe
Size

1.0MB
MD5

c5598feb9aa8270fde3defea2a203a76
SHA1

379fbd3105c65b562b4c5d94a6a61db4c9755a78
SHA256

dfc9ecd681ac21c94bae46bb1f511b2b1c3897296abf84cc1b33d6ccbee86fae
SHA512

f0f9bfdc676289b0d387ed07f5439d8008e7df2985020e555f89b6fcc242fa48d81985dbe37470f2d623da4c603e89832d38b022ea6815102069a37df1dd3ea0
SSDEEP

12288:w4qd6aRELyuaoLM3zwO59ds8ymea8e6IVFAIMVGJYIdCkXNksClcamrAqZaKgv:w4qdwLy4AB8lSWoGzs1rih

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

Processes:

resource	yara_rule
behavioral1/memory/968-56-0x0000000000400000-0x00000000004A4000-memory.dmp	dcrat
behavioral1/memory/968-61-0x000000000049EE2E-mapping.dmp	dcrat
behavioral1/memory/968-63-0x0000000000400000-0x00000000004A4000-memory.dmp	dcrat
behavioral1/memory/968-62-0x0000000000400000-0x00000000004A4000-memory.dmp	dcrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

c5598feb9aa8270fde3defea2a203a76.exe

description pid process target process

PID 1248 set thread context of 968 1248 c5598feb9aa8270fde3defea2a203a76.exe AppLaunch.exe

description	pid	process	target process
PID 1248 set thread context of 968	1248	c5598feb9aa8270fde3defea2a203a76.exe	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 968 AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	968	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c5598feb9aa8270fde3defea2a203a76.exe

description	pid	process	target process
PID 1248 wrote to memory of 968	1248	c5598feb9aa8270fde3defea2a203a76.exe	AppLaunch.exe
PID 1248 wrote to memory of 968	1248	c5598feb9aa8270fde3defea2a203a76.exe	AppLaunch.exe
PID 1248 wrote to memory of 968	1248	c5598feb9aa8270fde3defea2a203a76.exe	AppLaunch.exe
PID 1248 wrote to memory of 968	1248	c5598feb9aa8270fde3defea2a203a76.exe	AppLaunch.exe
PID 1248 wrote to memory of 968	1248	c5598feb9aa8270fde3defea2a203a76.exe	AppLaunch.exe
PID 1248 wrote to memory of 968	1248	c5598feb9aa8270fde3defea2a203a76.exe	AppLaunch.exe
PID 1248 wrote to memory of 968	1248	c5598feb9aa8270fde3defea2a203a76.exe	AppLaunch.exe
PID 1248 wrote to memory of 968	1248	c5598feb9aa8270fde3defea2a203a76.exe	AppLaunch.exe
PID 1248 wrote to memory of 968	1248	c5598feb9aa8270fde3defea2a203a76.exe	AppLaunch.exe

memory/968-54-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/968-56-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/968-61-0x000000000049EE2E-mapping.dmp

Download
memory/968-63-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/968-62-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/968-64-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/968-65-0x0000000000590000-0x00000000005AC000-memory.dmp

Filesize
112KB

Download
memory/968-66-0x00000000005D0000-0x00000000005E6000-memory.dmp

Filesize
88KB

Download