dcrat | e041951b9084d03b1685ed2fdea5587258b721c0c57940fea6167656bf2c69f7

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
11-01-2023 12:52

Target

e041951b9084d03b1685ed2fdea5587258b721c0c57940fea6167656bf2c69f7.exe
Size

2.0MB
MD5

182fd62fdf57aaf29a889c1b65c65a2d
SHA1

bf4a705fb1a061590a50d4ce9e059c24c00b7a96
SHA256

e041951b9084d03b1685ed2fdea5587258b721c0c57940fea6167656bf2c69f7
SHA512

560028e45bb43279fb12e214683c021ca5e83d2f07419a9f68806a9dac47bc187cc62f3fdf82a53e1ec3724a2cd06be04759efec57a41895e50d061304fb4a37
SSDEEP

49152:dndSiKG7Idc6Rm8sDJMSgkdEiVTpnjyv:dhURm8vSFVov

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

Processes:

resource	yara_rule
behavioral1/memory/616-54-0x0000000000E60000-0x000000000105A000-memory.dmp	dcrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e041951b9084d03b1685ed2fdea5587258b721c0c57940fea6167656bf2c69f7.exe

description pid process

Token: SeDebugPrivilege 616 e041951b9084d03b1685ed2fdea5587258b721c0c57940fea6167656bf2c69f7.exe

description	pid	process
Token: SeDebugPrivilege	616	e041951b9084d03b1685ed2fdea5587258b721c0c57940fea6167656bf2c69f7.exe

C:\Users\Admin\AppData\Local\Temp\e041951b9084d03b1685ed2fdea5587258b721c0c57940fea6167656bf2c69f7.exe
"C:\Users\Admin\AppData\Local\Temp\e041951b9084d03b1685ed2fdea5587258b721c0c57940fea6167656bf2c69f7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:616

memory/616-54-0x0000000000E60000-0x000000000105A000-memory.dmp

Filesize
2.0MB

Download
memory/616-55-0x0000000000240000-0x000000000024E000-memory.dmp

Filesize
56KB

Download
memory/616-56-0x0000000000250000-0x000000000025E000-memory.dmp

Filesize
56KB

Download