Overview

overview

10

Static

static

10

AllergiesL...df.scr

windows7-x64

10

AllergiesL...df.scr

windows10-2004-x64

10

Analysis

  • max time kernel
    71s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    07-06-2023 04:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AllergiesList/Allergies List and Allowed Substances.numb05151.pdf.scr

  • Size

    920.3MB

  • MD5

    491c5ac82977262ef24bd22ad312c622

  • SHA1

    1f0555370f07e94182059701f63e940429757157

  • SHA256

    ea770032c44e773b9c9865d4ff3bfb10f76b003ace1bbfbe45755ffff227e5fe

  • SHA512

    a9974fe623a979e12d8493200f36aa4aab5763ea97ed4d5924fb1f579038d686bb10d789d576343ce4ca4c8a4657ed9404b7ffb52f701f6f880eb75e766f6734

  • SSDEEP

    393216:rc8yiMPNWZV4nXF12elEA7YKsHES/Sl50l:rcOMPNWTM2elpBtSwW

Score
10/10
dcratinfostealerrat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • .NET Reactor proctector 35 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AllergiesList\Allergies List and Allowed Substances.numb05151.pdf.scr
    "C:\Users\Admin\AppData\Local\Temp\AllergiesList\Allergies List and Allowed Substances.numb05151.pdf.scr" /S
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:924
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
        PID:580
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        2⤵
          PID:1628
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          2⤵
            PID:1028
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            2⤵
              PID:980
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              2⤵
                PID:1112

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/924-54-0x0000000000E90000-0x00000000037F6000-memory.dmp
              Filesize

              41.4MB

              Download
            • memory/924-55-0x0000000000B60000-0x0000000000BE0000-memory.dmp
              Filesize

              512KB

              Download
            • memory/924-56-0x000000001DAD0000-0x000000001DC26000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-57-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-58-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-62-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-60-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-64-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-66-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-68-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-70-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-72-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-76-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-74-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-80-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-78-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-82-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-88-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-86-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-84-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-94-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-92-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-90-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-98-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-96-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-102-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-100-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-106-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-104-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-108-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-114-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-112-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-110-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-118-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-116-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-120-0x000000001DAD0000-0x000000001DC20000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/924-1832-0x0000000000B60000-0x0000000000BE0000-memory.dmp
              Filesize

              512KB

              Download