dcrat | c691c174c042a1f23f13b420abad454bd4b843e1033119080114da0a99cfdfff

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 16:29

Target

9hmhx13dh.exe
Size

2.3MB
MD5

4dc6391e49046252c6effd467c679804
SHA1

19b4ae58c609825294a66643fdb5779e04957aab
SHA256

c691c174c042a1f23f13b420abad454bd4b843e1033119080114da0a99cfdfff
SHA512

b78ab0ba6aa99bb516cf4445bec01548801430863630e53d7a08dc985cfbd360455937369ce94242886fecd4ddf7f877fb284b50881119271d5eae59a8ab83b4
SSDEEP

49152:TZM+U574kFRDQc2bUyVe/l/usb/iC+nkalNs+IIWpxIF989O3:T+7pfRPV/l/v/iC+kye+hex3

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

Processes:

resource	yara_rule
behavioral2/memory/4756-133-0x0000000000400000-0x00000000005E2000-memory.dmp	dcrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

9hmhx13dh.exe

description pid process target process

PID 3012 set thread context of 4756 3012 9hmhx13dh.exe InstallUtil.exe

description	pid	process	target process
PID 3012 set thread context of 4756	3012	9hmhx13dh.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

InstallUtil.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

InstallUtil.exe

pid process

4756 InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

InstallUtil.exe

description pid process

Token: SeDebugPrivilege 4756 InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	4756	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9hmhx13dh.exe

description	pid	process	target process
PID 3012 wrote to memory of 4756	3012	9hmhx13dh.exe	InstallUtil.exe
PID 3012 wrote to memory of 4756	3012	9hmhx13dh.exe	InstallUtil.exe
PID 3012 wrote to memory of 4756	3012	9hmhx13dh.exe	InstallUtil.exe
PID 3012 wrote to memory of 4756	3012	9hmhx13dh.exe	InstallUtil.exe
PID 3012 wrote to memory of 4756	3012	9hmhx13dh.exe	InstallUtil.exe
PID 3012 wrote to memory of 4756	3012	9hmhx13dh.exe	InstallUtil.exe
PID 3012 wrote to memory of 4756	3012	9hmhx13dh.exe	InstallUtil.exe
PID 3012 wrote to memory of 4756	3012	9hmhx13dh.exe	InstallUtil.exe

memory/4756-132-0x0000000000000000-mapping.dmp

Download
memory/4756-133-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/4756-134-0x0000000005C20000-0x00000000061C4000-memory.dmp

Filesize
5.6MB

Download
memory/4756-135-0x0000000005990000-0x00000000059E0000-memory.dmp

Filesize
320KB

Download
memory/4756-136-0x00000000073D0000-0x0000000007462000-memory.dmp

Filesize
584KB

Download
memory/4756-137-0x00000000079A0000-0x0000000007ECC000-memory.dmp

Filesize
5.2MB

Download
memory/4756-138-0x00000000075E0000-0x0000000007646000-memory.dmp

Filesize
408KB

Download