dcrat | 29b84cbec0c92620955afd16358fb786df50fdc6dc024399cc9d2f5d8f40f38a

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21-01-2023 19:03

Target

LoaderB.exe
Size

1.1MB
MD5

97fd39727f09d456c6e6e8a3fb9b4028
SHA1

f27399f10573bb39ebc472b7fdfa649e48494dfd
SHA256

29b84cbec0c92620955afd16358fb786df50fdc6dc024399cc9d2f5d8f40f38a
SHA512

275a115ce4bb2662658a6d6ad77a3a83005d66d9d773726581ead4f38bf45b9e6c5d98501cfc0ec3c2623b04635856ca303ee89c7ec114ab01268741928f9a46
SSDEEP

24576:qGlFYoq77FED1/LTeXGVFkz/EaQON6uZvRbXiPoUg:HFf+6DNiwaT08XiPoUg

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

Processes:

resource	yara_rule
behavioral1/memory/2040-56-0x0000000000090000-0x00000000000E6000-memory.dmp	dcrat
behavioral1/memory/2040-61-0x00000000000E083E-mapping.dmp	dcrat
behavioral1/memory/2040-62-0x0000000000090000-0x00000000000E6000-memory.dmp	dcrat
behavioral1/memory/2040-63-0x0000000000090000-0x00000000000E6000-memory.dmp	dcrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

LoaderB.exe

description pid process target process

PID 1284 set thread context of 2040 1284 LoaderB.exe AppLaunch.exe

description	pid	process	target process
PID 1284 set thread context of 2040	1284	LoaderB.exe	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 2040 AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2040	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

LoaderB.exe

description	pid	process	target process
PID 1284 wrote to memory of 2040	1284	LoaderB.exe	AppLaunch.exe
PID 1284 wrote to memory of 2040	1284	LoaderB.exe	AppLaunch.exe
PID 1284 wrote to memory of 2040	1284	LoaderB.exe	AppLaunch.exe
PID 1284 wrote to memory of 2040	1284	LoaderB.exe	AppLaunch.exe
PID 1284 wrote to memory of 2040	1284	LoaderB.exe	AppLaunch.exe
PID 1284 wrote to memory of 2040	1284	LoaderB.exe	AppLaunch.exe
PID 1284 wrote to memory of 2040	1284	LoaderB.exe	AppLaunch.exe
PID 1284 wrote to memory of 2040	1284	LoaderB.exe	AppLaunch.exe
PID 1284 wrote to memory of 2040	1284	LoaderB.exe	AppLaunch.exe

memory/2040-54-0x0000000000090000-0x00000000000E6000-memory.dmp

Filesize
344KB

Download
memory/2040-56-0x0000000000090000-0x00000000000E6000-memory.dmp

Filesize
344KB

Download
memory/2040-61-0x00000000000E083E-mapping.dmp

Download
memory/2040-62-0x0000000000090000-0x00000000000E6000-memory.dmp

Filesize
344KB

Download
memory/2040-63-0x0000000000090000-0x00000000000E6000-memory.dmp

Filesize
344KB

Download
memory/2040-64-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download