Analysis
-
max time kernel
93s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2023 01:02
Behavioral task
behavioral1
Sample
746cf06882b23f72a1f61783ef15bc50309a451abf181f80342565e89e51e04b.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
746cf06882b23f72a1f61783ef15bc50309a451abf181f80342565e89e51e04b.exe
Resource
win10v2004-20230221-en
General
-
Target
746cf06882b23f72a1f61783ef15bc50309a451abf181f80342565e89e51e04b.exe
-
Size
829KB
-
MD5
0b68b6976ce7b3b7932a35a00160e38c
-
SHA1
14d43c43292d417da6bbac21491dcf346a4bc0de
-
SHA256
746cf06882b23f72a1f61783ef15bc50309a451abf181f80342565e89e51e04b
-
SHA512
7f16da4b0782a351182db85d9315f9057c0ad6996885eeb2111ffad561818a9f487ca6a4444cd50b25667a73b66b3390f45414c4bbb397450afe21f5284541d3
-
SSDEEP
12288:+f26x3stG2zpTYlbCXdOm6r2i8hiPafbxjkAdbV3knD7nsTVkmT:CStJt0lbXm6r2imlkpnD7nsTVkC
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Processes:
resource yara_rule behavioral2/memory/4104-133-0x00000000008D0000-0x00000000009A6000-memory.dmp dcrat -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
746cf06882b23f72a1f61783ef15bc50309a451abf181f80342565e89e51e04b.exepid process 4104 746cf06882b23f72a1f61783ef15bc50309a451abf181f80342565e89e51e04b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
746cf06882b23f72a1f61783ef15bc50309a451abf181f80342565e89e51e04b.exedescription pid process Token: SeDebugPrivilege 4104 746cf06882b23f72a1f61783ef15bc50309a451abf181f80342565e89e51e04b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\746cf06882b23f72a1f61783ef15bc50309a451abf181f80342565e89e51e04b.exe"C:\Users\Admin\AppData\Local\Temp\746cf06882b23f72a1f61783ef15bc50309a451abf181f80342565e89e51e04b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken