dcrat | a77c89b6d4961bb56c53196685ed97b01f7e49f5606e15b80ba0034e422b1029

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-01-2023 11:49

Target

a77c89b6d4961bb56c53196685ed97b01f7e49f5606e15b80ba0034e422b1029.exe
Size

2.0MB
MD5

45ad397238e5e447aef495a80218019a
SHA1

23ee937bb616025ae0185c98ab183e9282c525da
SHA256

a77c89b6d4961bb56c53196685ed97b01f7e49f5606e15b80ba0034e422b1029
SHA512

c981a1c6bb7f0c28bf2fa07c23ca06f9c12f113457114eade25a8c8ad79fb01edf84719b2ed59fa61ecf9943b470328a92afee1b8c234b7549f1cad2d99e2c75
SSDEEP

49152:dndSiKG7Idc6Rm8sDJMSgkdEiVTpnjyv:dhURm8vSFVov

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

Processes:

resource	yara_rule
behavioral1/memory/1976-54-0x0000000000850000-0x0000000000A4A000-memory.dmp	dcrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a77c89b6d4961bb56c53196685ed97b01f7e49f5606e15b80ba0034e422b1029.exe

description pid process

Token: SeDebugPrivilege 1976 a77c89b6d4961bb56c53196685ed97b01f7e49f5606e15b80ba0034e422b1029.exe

description	pid	process
Token: SeDebugPrivilege	1976	a77c89b6d4961bb56c53196685ed97b01f7e49f5606e15b80ba0034e422b1029.exe

C:\Users\Admin\AppData\Local\Temp\a77c89b6d4961bb56c53196685ed97b01f7e49f5606e15b80ba0034e422b1029.exe
"C:\Users\Admin\AppData\Local\Temp\a77c89b6d4961bb56c53196685ed97b01f7e49f5606e15b80ba0034e422b1029.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976

memory/1976-54-0x0000000000850000-0x0000000000A4A000-memory.dmp

Filesize
2.0MB

Download
memory/1976-55-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download
memory/1976-56-0x0000000000150000-0x000000000015E000-memory.dmp

Filesize
56KB

Download