dcrat | 278b30b6a9c6ffba21a71c5cad9f4b64d383b868e79098be97a5b92cb57e6667 | Triage

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21-01-2023 19:01

Sharing

Report Analysis Logs

General

Target

Loader.exe
Size

2.0MB
MD5

f763d6937405d921474f3996910dc816
SHA1

e81cd22b8e4a361c20c926d2aecdbe231274a656
SHA256

278b30b6a9c6ffba21a71c5cad9f4b64d383b868e79098be97a5b92cb57e6667
SHA512

c0dd64b26c1ce01336690b9c9ed90bcfbab07f61d94a04ce4be5965e5b59f0d31c48760b08ac0a4654f8569ab9dbf66b5568300d3a5e34c5c3dd62ddc07b5bfc
SSDEEP

49152:Ub9F/IKSPFHC6AGjAfqeOg/sFGSYxXNPEYLi2TZCYclIcM:Ub7IFPFHXX+xdPdDTZCJac

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

Processes:

resource	yara_rule
behavioral1/memory/1264-54-0x0000000001000000-0x0000000001204000-memory.dmp	dcrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Loader.exe

description pid process

Token: SeDebugPrivilege 1264 Loader.exe

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-54-0x0000000001000000-0x0000000001204000-memory.dmp

Filesize
2.0MB

Download
memory/1264-55-0x0000000000B90000-0x0000000000B9E000-memory.dmp

Filesize
56KB

Download