dcrat | c691c174c042a1f23f13b420abad454bd4b843e1033119080114da0a99cfdfff

Analysis

max time kernel
91s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2023 08:11

Target

9hmhx13dh.exe
Size

2.3MB
MD5

4dc6391e49046252c6effd467c679804
SHA1

19b4ae58c609825294a66643fdb5779e04957aab
SHA256

c691c174c042a1f23f13b420abad454bd4b843e1033119080114da0a99cfdfff
SHA512

b78ab0ba6aa99bb516cf4445bec01548801430863630e53d7a08dc985cfbd360455937369ce94242886fecd4ddf7f877fb284b50881119271d5eae59a8ab83b4
SSDEEP

49152:TZM+U574kFRDQc2bUyVe/l/usb/iC+nkalNs+IIWpxIF989O3:T+7pfRPV/l/v/iC+kye+hex3

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

Processes:

resource	yara_rule
behavioral2/memory/3860-133-0x0000000000400000-0x00000000005E2000-memory.dmp	dcrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

9hmhx13dh.exe

description pid process target process

PID 4644 set thread context of 3860 4644 9hmhx13dh.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

InstallUtil.exe

pid process

3860 InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

InstallUtil.exe

description pid process

Token: SeDebugPrivilege 3860 InstallUtil.exe

description	pid	process	target process
PID 4644 set thread context of 3860	4644	9hmhx13dh.exe	InstallUtil.exe

pid	process
3860	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	3860	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9hmhx13dh.exe

description	pid	process	target process
PID 4644 wrote to memory of 3860	4644	9hmhx13dh.exe	InstallUtil.exe
PID 4644 wrote to memory of 3860	4644	9hmhx13dh.exe	InstallUtil.exe
PID 4644 wrote to memory of 3860	4644	9hmhx13dh.exe	InstallUtil.exe
PID 4644 wrote to memory of 3860	4644	9hmhx13dh.exe	InstallUtil.exe
PID 4644 wrote to memory of 3860	4644	9hmhx13dh.exe	InstallUtil.exe
PID 4644 wrote to memory of 3860	4644	9hmhx13dh.exe	InstallUtil.exe
PID 4644 wrote to memory of 3860	4644	9hmhx13dh.exe	InstallUtil.exe
PID 4644 wrote to memory of 3860	4644	9hmhx13dh.exe	InstallUtil.exe

memory/3860-132-0x0000000000000000-mapping.dmp

Download
memory/3860-133-0x0000000000400000-0x00000000005E2000-memory.dmp

Filesize
1.9MB

Download
memory/3860-134-0x0000000006430000-0x00000000069D4000-memory.dmp

Filesize
5.6MB

Download
memory/3860-135-0x0000000005FC0000-0x0000000006010000-memory.dmp

Filesize
320KB

Download
memory/3860-136-0x0000000006250000-0x00000000062E2000-memory.dmp

Filesize
584KB

Download
memory/3860-137-0x0000000008060000-0x000000000858C000-memory.dmp

Filesize
5.2MB

Download
memory/3860-138-0x0000000007CE0000-0x0000000007D46000-memory.dmp

Filesize
408KB

Download