dcrat | c691c174c042a1f23f13b420abad454bd4b843e1033119080114da0a99cfdfff

Analysis

max time kernel
35s
max time network
37s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-01-2023 08:11

Target

9hmhx13dh.exe
Size

2.3MB
MD5

4dc6391e49046252c6effd467c679804
SHA1

19b4ae58c609825294a66643fdb5779e04957aab
SHA256

c691c174c042a1f23f13b420abad454bd4b843e1033119080114da0a99cfdfff
SHA512

b78ab0ba6aa99bb516cf4445bec01548801430863630e53d7a08dc985cfbd360455937369ce94242886fecd4ddf7f877fb284b50881119271d5eae59a8ab83b4
SSDEEP

49152:TZM+U574kFRDQc2bUyVe/l/usb/iC+nkalNs+IIWpxIF989O3:T+7pfRPV/l/v/iC+kye+hex3

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

Processes:

resource	yara_rule
behavioral1/memory/1332-54-0x0000000000400000-0x00000000005E2000-memory.dmp	dcrat
behavioral1/memory/1332-55-0x00000000005DCE6E-mapping.dmp	dcrat
behavioral1/memory/1332-57-0x0000000000400000-0x00000000005E2000-memory.dmp	dcrat
behavioral1/memory/1332-59-0x0000000000400000-0x00000000005E2000-memory.dmp	dcrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

9hmhx13dh.exe

description pid process target process

PID 1292 set thread context of 1332 1292 9hmhx13dh.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

InstallUtil.exe

pid process

1332 InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

InstallUtil.exe

description pid process

Token: SeDebugPrivilege 1332 InstallUtil.exe

description	pid	process	target process
PID 1292 set thread context of 1332	1292	9hmhx13dh.exe	InstallUtil.exe

pid	process
1332	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1332	InstallUtil.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

9hmhx13dh.exe

description	pid	process	target process
PID 1292 wrote to memory of 1188	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1188	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1188	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1188	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1188	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1188	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1188	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1332	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1332	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1332	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1332	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1332	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1332	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1332	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1332	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1332	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1332	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1332	1292	9hmhx13dh.exe	InstallUtil.exe
PID 1292 wrote to memory of 1332	1292	9hmhx13dh.exe	InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:1188

memory/1332-54-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/1332-55-0x00000000005DCE6E-mapping.dmp

Download
memory/1332-57-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/1332-59-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/1332-60-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/1332-61-0x00000000002E0000-0x00000000002FC000-memory.dmp

Filesize
112KB

Download
memory/1332-62-0x0000000000310000-0x0000000000326000-memory.dmp

Filesize
88KB

Download
memory/1332-63-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/1332-64-0x0000000004B30000-0x0000000004B86000-memory.dmp

Filesize
344KB

Download
memory/1332-65-0x00000000003E0000-0x00000000003F2000-memory.dmp

Filesize
72KB

Download
memory/1332-66-0x00000000005F0000-0x00000000005FE000-memory.dmp

Filesize
56KB

Download