Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
11-01-2023 12:56
General
-
Target
23c029a48657439e61ce7e4348c40cf4c16eab707daef32e077bf99e66440c99.exe
-
Size
2.0MB
-
MD5
1530d40f7b9ad28b44afabe0d1376a45
-
SHA1
3f1fcd7c237cddb643dca6d8495633023009cd76
-
SHA256
23c029a48657439e61ce7e4348c40cf4c16eab707daef32e077bf99e66440c99
-
SHA512
b8e9fe8420c495aebea953554fa234f6509fb5492e34b64a5c46f1b489c83676ff4ae4c9b18b7e57adaaa2b1cd09b54144ae5926390b4594aca3b7ec97fbc294
-
SSDEEP
49152:HndSiKG7Idc6Rm8sDJMSgkdEiVTpnjyv:HhURm8vSFVov
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\23c029a48657439e61ce7e4348c40cf4c16eab707daef32e077bf99e66440c99.exe"C:\Users\Admin\AppData\Local\Temp\23c029a48657439e61ce7e4348c40cf4c16eab707daef32e077bf99e66440c99.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2104-132-0x0000000000EE0000-0x00000000010DA000-memory.dmpFilesize
2.0MB
-
memory/2104-133-0x00007FF8A6C90000-0x00007FF8A7751000-memory.dmpFilesize
10.8MB
-
memory/2104-134-0x00007FF8A6C90000-0x00007FF8A7751000-memory.dmpFilesize
10.8MB