dcrat | c691c174c042a1f23f13b420abad454bd4b843e1033119080114da0a99cfdfff

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 16:29

Target

9hmhx13dh.exe
Size

2.3MB
MD5

4dc6391e49046252c6effd467c679804
SHA1

19b4ae58c609825294a66643fdb5779e04957aab
SHA256

c691c174c042a1f23f13b420abad454bd4b843e1033119080114da0a99cfdfff
SHA512

b78ab0ba6aa99bb516cf4445bec01548801430863630e53d7a08dc985cfbd360455937369ce94242886fecd4ddf7f877fb284b50881119271d5eae59a8ab83b4
SSDEEP

49152:TZM+U574kFRDQc2bUyVe/l/usb/iC+nkalNs+IIWpxIF989O3:T+7pfRPV/l/v/iC+kye+hex3

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

Processes:

resource	yara_rule
behavioral1/memory/1788-55-0x00000000005DCE6E-mapping.dmp	dcrat
behavioral1/memory/1788-54-0x0000000000400000-0x00000000005E2000-memory.dmp	dcrat
behavioral1/memory/1788-57-0x0000000000400000-0x00000000005E2000-memory.dmp	dcrat
behavioral1/memory/1788-59-0x0000000000400000-0x00000000005E2000-memory.dmp	dcrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

9hmhx13dh.exe

description pid process target process

PID 1224 set thread context of 1788 1224 9hmhx13dh.exe InstallUtil.exe

description	pid	process	target process
PID 1224 set thread context of 1788	1224	9hmhx13dh.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

InstallUtil.exe

description pid process

Token: SeDebugPrivilege 1788 InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1788	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9hmhx13dh.exe

description	pid	process	target process
PID 1224 wrote to memory of 1788	1224	9hmhx13dh.exe	InstallUtil.exe
PID 1224 wrote to memory of 1788	1224	9hmhx13dh.exe	InstallUtil.exe
PID 1224 wrote to memory of 1788	1224	9hmhx13dh.exe	InstallUtil.exe
PID 1224 wrote to memory of 1788	1224	9hmhx13dh.exe	InstallUtil.exe
PID 1224 wrote to memory of 1788	1224	9hmhx13dh.exe	InstallUtil.exe
PID 1224 wrote to memory of 1788	1224	9hmhx13dh.exe	InstallUtil.exe
PID 1224 wrote to memory of 1788	1224	9hmhx13dh.exe	InstallUtil.exe
PID 1224 wrote to memory of 1788	1224	9hmhx13dh.exe	InstallUtil.exe
PID 1224 wrote to memory of 1788	1224	9hmhx13dh.exe	InstallUtil.exe
PID 1224 wrote to memory of 1788	1224	9hmhx13dh.exe	InstallUtil.exe
PID 1224 wrote to memory of 1788	1224	9hmhx13dh.exe	InstallUtil.exe
PID 1224 wrote to memory of 1788	1224	9hmhx13dh.exe	InstallUtil.exe

memory/1788-55-0x00000000005DCE6E-mapping.dmp

Download
memory/1788-54-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/1788-57-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/1788-59-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/1788-60-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1788-61-0x0000000000B00000-0x0000000000B1C000-memory.dmp

Filesize
112KB

Download
memory/1788-62-0x0000000000B30000-0x0000000000B46000-memory.dmp

Filesize
88KB

Download
memory/1788-63-0x0000000000B60000-0x0000000000B72000-memory.dmp

Filesize
72KB

Download
memory/1788-64-0x0000000000E10000-0x0000000000E66000-memory.dmp

Filesize
344KB

Download
memory/1788-65-0x0000000000BE0000-0x0000000000BF2000-memory.dmp

Filesize
72KB

Download
memory/1788-66-0x0000000000C80000-0x0000000000C8E000-memory.dmp

Filesize
56KB

Download