Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
23-01-2023 13:51
General
-
Target
15dea4b9a33481b1fda13ff2382af181ef556877a7401d1d3451309b4aef1317.exe
-
Size
4.0MB
-
MD5
052b57ab4e7144f3a63a77e7ecc3576e
-
SHA1
39a2ecfca50de7ec6a212d9ab80add96d884c6e5
-
SHA256
15dea4b9a33481b1fda13ff2382af181ef556877a7401d1d3451309b4aef1317
-
SHA512
8cf5bf0a973750ed167f5a6c7d0395d0b0fbcd829e67294d3634f9e5f033587b3d2e75dd63e6e93c134c98f8a6cd435f68b1613df35e8bc03cecda3889430f9c
-
SSDEEP
98304:JCeCsdoOk1Qqrx+14KBDYauafqeu3M5qOmCc8:hdnkOq4iYEauaft4gtZ
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15dea4b9a33481b1fda13ff2382af181ef556877a7401d1d3451309b4aef1317.exe"C:\Users\Admin\AppData\Local\Temp\15dea4b9a33481b1fda13ff2382af181ef556877a7401d1d3451309b4aef1317.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/904-54-0x0000000001380000-0x0000000001786000-memory.dmpFilesize
4.0MB
-
memory/904-55-0x00000000004D0000-0x00000000004DE000-memory.dmpFilesize
56KB