Overview

overview

10

Static

static

c5598feb9a...76.exe

windows7-x64

10

c5598feb9a...76.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-01-2023 06:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c5598feb9aa8270fde3defea2a203a76.exe

  • Size

    1.0MB

  • MD5

    c5598feb9aa8270fde3defea2a203a76

  • SHA1

    379fbd3105c65b562b4c5d94a6a61db4c9755a78

  • SHA256

    dfc9ecd681ac21c94bae46bb1f511b2b1c3897296abf84cc1b33d6ccbee86fae

  • SHA512

    f0f9bfdc676289b0d387ed07f5439d8008e7df2985020e555f89b6fcc242fa48d81985dbe37470f2d623da4c603e89832d38b022ea6815102069a37df1dd3ea0

  • SSDEEP

    12288:w4qd6aRELyuaoLM3zwO59ds8ymea8e6IVFAIMVGJYIdCkXNksClcamrAqZaKgv:w4qdwLy4AB8lSWoGzs1rih

Score
10/10
dcratinfostealerrat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5598feb9aa8270fde3defea2a203a76.exe
    "C:\Users\Admin\AppData\Local\Temp\c5598feb9aa8270fde3defea2a203a76.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2324-132-0x0000000000000000-mapping.dmp
    Download
  • memory/2324-133-0x0000000000400000-0x00000000004A4000-memory.dmp
    Filesize

    656KB

    Download
  • memory/2324-138-0x0000000005D50000-0x00000000062F4000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/2324-139-0x0000000005A90000-0x0000000005AE0000-memory.dmp
    Filesize

    320KB

    Download
  • memory/2324-140-0x0000000000EC0000-0x0000000000F52000-memory.dmp
    Filesize

    584KB

    Download
  • memory/2324-141-0x0000000005970000-0x00000000059D6000-memory.dmp
    Filesize

    408KB

    Download