dcrat | 5a5e3d70cd466c1fd8b96432c3e547d1219f87562450259393b51780b65a201d

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2023 00:40

Target

file.exe
Size

1.5MB
MD5

ecee2ebd3ec0c0d36f88475532eddbef
SHA1

c68350688ae49166da20529076bc6e09ece54972
SHA256

5a5e3d70cd466c1fd8b96432c3e547d1219f87562450259393b51780b65a201d
SHA512

6761c27b5eefa8005f4a175df4f17bbfb84cda2ecd47a894a8afbafd0a8e05b102e93f795a291e29e1a8736c9a55d573d08827dd48bfe20045f73796954c5232
SSDEEP

12288:RajiyzjakY85lAi78xkprnzbBxo0O57I3WkctrO73yvKbXRXy2/xcehJNHtIEwyk:RhmYpiwC7BxLOyWj2F/jzNIEF30

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

Processes:

resource	yara_rule
behavioral2/memory/4268-133-0x0000000000400000-0x00000000004A4000-memory.dmp	dcrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 5052 set thread context of 4268 5052 file.exe InstallUtil.exe

description	pid	process	target process
PID 5052 set thread context of 4268	5052	file.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

InstallUtil.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

InstallUtil.exe

pid process

4268 InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

InstallUtil.exe

description pid process

Token: SeDebugPrivilege 4268 InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	4268	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

file.exe

description	pid	process	target process
PID 5052 wrote to memory of 4268	5052	file.exe	InstallUtil.exe
PID 5052 wrote to memory of 4268	5052	file.exe	InstallUtil.exe
PID 5052 wrote to memory of 4268	5052	file.exe	InstallUtil.exe
PID 5052 wrote to memory of 4268	5052	file.exe	InstallUtil.exe
PID 5052 wrote to memory of 4268	5052	file.exe	InstallUtil.exe
PID 5052 wrote to memory of 4268	5052	file.exe	InstallUtil.exe
PID 5052 wrote to memory of 4268	5052	file.exe	InstallUtil.exe
PID 5052 wrote to memory of 4268	5052	file.exe	InstallUtil.exe

memory/4268-133-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4268-134-0x0000000006050000-0x00000000065F4000-memory.dmp

Filesize
5.6MB

Download
memory/4268-135-0x00000000055D0000-0x00000000055E0000-memory.dmp

Filesize
64KB

Download
memory/4268-136-0x0000000005DD0000-0x0000000005E20000-memory.dmp

Filesize
320KB

Download
memory/4268-137-0x0000000006C20000-0x0000000006CB2000-memory.dmp

Filesize
584KB

Download
memory/4268-138-0x0000000006E30000-0x0000000006E96000-memory.dmp

Filesize
408KB

Download
memory/4268-139-0x00000000055D0000-0x00000000055E0000-memory.dmp

Filesize
64KB

Download