Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-01-2023 12:55
Behavioral task
behavioral1
Sample
23c029a48657439e61ce7e4348c40cf4c16eab707daef32e077bf99e66440c99.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
23c029a48657439e61ce7e4348c40cf4c16eab707daef32e077bf99e66440c99.exe
Resource
win10v2004-20220812-en
General
-
Target
23c029a48657439e61ce7e4348c40cf4c16eab707daef32e077bf99e66440c99.exe
-
Size
2.0MB
-
MD5
1530d40f7b9ad28b44afabe0d1376a45
-
SHA1
3f1fcd7c237cddb643dca6d8495633023009cd76
-
SHA256
23c029a48657439e61ce7e4348c40cf4c16eab707daef32e077bf99e66440c99
-
SHA512
b8e9fe8420c495aebea953554fa234f6509fb5492e34b64a5c46f1b489c83676ff4ae4c9b18b7e57adaaa2b1cd09b54144ae5926390b4594aca3b7ec97fbc294
-
SSDEEP
49152:HndSiKG7Idc6Rm8sDJMSgkdEiVTpnjyv:HhURm8vSFVov
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Processes:
resource yara_rule behavioral1/memory/904-54-0x0000000001100000-0x00000000012FA000-memory.dmp dcrat -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
23c029a48657439e61ce7e4348c40cf4c16eab707daef32e077bf99e66440c99.exedescription pid process Token: SeDebugPrivilege 904 23c029a48657439e61ce7e4348c40cf4c16eab707daef32e077bf99e66440c99.exe