Analysis
-
max time kernel
61s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
11-01-2023 12:09
General
-
Target
395d65f4b35591f0505f24aae432c82f802f095ddc1a1b279f29066d0cb9fc56.exe
-
Size
2.0MB
-
MD5
43c3a083ad45c159332bd1f5978b86c9
-
SHA1
b53004cd9daabc1ddb78ece54f678b8e5d0a48a1
-
SHA256
395d65f4b35591f0505f24aae432c82f802f095ddc1a1b279f29066d0cb9fc56
-
SHA512
cce0b15e71cc2b050a3578f6e9c1ca7d9973fed491bd55b37451195e0c227188ec47300ed6c91c8b1f80363d2993985e621a686a24948d38de6965d1b06f8086
-
SSDEEP
49152:dndSiKG7Idc6Rm8sDJMSgkdEiVTpnjyv:dhURm8vSFVov
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\395d65f4b35591f0505f24aae432c82f802f095ddc1a1b279f29066d0cb9fc56.exe"C:\Users\Admin\AppData\Local\Temp\395d65f4b35591f0505f24aae432c82f802f095ddc1a1b279f29066d0cb9fc56.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2480-132-0x0000000000740000-0x000000000093A000-memory.dmpFilesize
2.0MB
-
memory/2480-133-0x00007FFD38110000-0x00007FFD38BD1000-memory.dmpFilesize
10.8MB
-
memory/2480-134-0x00007FFD38110000-0x00007FFD38BD1000-memory.dmpFilesize
10.8MB