dcrat | 5a5e3d70cd466c1fd8b96432c3e547d1219f87562450259393b51780b65a201d

Analysis

max time kernel
48s
max time network
148s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28-05-2023 00:40

Target

file.exe
Size

1.5MB
MD5

ecee2ebd3ec0c0d36f88475532eddbef
SHA1

c68350688ae49166da20529076bc6e09ece54972
SHA256

5a5e3d70cd466c1fd8b96432c3e547d1219f87562450259393b51780b65a201d
SHA512

6761c27b5eefa8005f4a175df4f17bbfb84cda2ecd47a894a8afbafd0a8e05b102e93f795a291e29e1a8736c9a55d573d08827dd48bfe20045f73796954c5232
SSDEEP

12288:RajiyzjakY85lAi78xkprnzbBxo0O57I3WkctrO73yvKbXRXy2/xcehJNHtIEwyk:RhmYpiwC7BxLOyWj2F/jzNIEF30

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

Processes:

resource	yara_rule
behavioral1/memory/2044-54-0x0000000000400000-0x00000000004A4000-memory.dmp	dcrat
behavioral1/memory/2044-58-0x0000000000400000-0x00000000004A4000-memory.dmp	dcrat
behavioral1/memory/2044-56-0x0000000000400000-0x00000000004A4000-memory.dmp	dcrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 928 set thread context of 2044 928 file.exe InstallUtil.exe

description	pid	process	target process
PID 928 set thread context of 2044	928	file.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

InstallUtil.exe

description pid process

Token: SeDebugPrivilege 2044 InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	2044	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

file.exe

description	pid	process	target process
PID 928 wrote to memory of 2044	928	file.exe	InstallUtil.exe
PID 928 wrote to memory of 2044	928	file.exe	InstallUtil.exe
PID 928 wrote to memory of 2044	928	file.exe	InstallUtil.exe
PID 928 wrote to memory of 2044	928	file.exe	InstallUtil.exe
PID 928 wrote to memory of 2044	928	file.exe	InstallUtil.exe
PID 928 wrote to memory of 2044	928	file.exe	InstallUtil.exe
PID 928 wrote to memory of 2044	928	file.exe	InstallUtil.exe
PID 928 wrote to memory of 2044	928	file.exe	InstallUtil.exe
PID 928 wrote to memory of 2044	928	file.exe	InstallUtil.exe
PID 928 wrote to memory of 2044	928	file.exe	InstallUtil.exe
PID 928 wrote to memory of 2044	928	file.exe	InstallUtil.exe
PID 928 wrote to memory of 2044	928	file.exe	InstallUtil.exe

memory/2044-54-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/2044-58-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/2044-56-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/2044-59-0x00000000004B0000-0x00000000004CC000-memory.dmp

Filesize
112KB

Download
memory/2044-60-0x00000000043A0000-0x00000000043E0000-memory.dmp

Filesize
256KB

Download
memory/2044-61-0x00000000004D0000-0x00000000004E6000-memory.dmp

Filesize
88KB

Download
memory/2044-67-0x00000000043A0000-0x00000000043E0000-memory.dmp

Filesize
256KB

Download