Overview

overview

10

Static

static

10

Allergies ...df.scr

windows7-x64

10

Allergies ...df.scr

windows10-2004-x64

10

Analysis

  • max time kernel
    69s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    07-06-2023 04:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Allergies List and Allowed Substances.numb05151.pdf.scr

  • Size

    920.3MB

  • MD5

    491c5ac82977262ef24bd22ad312c622

  • SHA1

    1f0555370f07e94182059701f63e940429757157

  • SHA256

    ea770032c44e773b9c9865d4ff3bfb10f76b003ace1bbfbe45755ffff227e5fe

  • SHA512

    a9974fe623a979e12d8493200f36aa4aab5763ea97ed4d5924fb1f579038d686bb10d789d576343ce4ca4c8a4657ed9404b7ffb52f701f6f880eb75e766f6734

  • SSDEEP

    393216:rc8yiMPNWZV4nXF12elEA7YKsHES/Sl50l:rcOMPNWTM2elpBtSwW

Score
10/10
dcratinfostealerrat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • .NET Reactor proctector 35 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Allergies List and Allowed Substances.numb05151.pdf.scr
    "C:\Users\Admin\AppData\Local\Temp\Allergies List and Allowed Substances.numb05151.pdf.scr" /S
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
        PID:540
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        2⤵
          PID:740
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          2⤵
            PID:1720
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            2⤵
              PID:1588
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              2⤵
                PID:1296

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1308-54-0x0000000000B00000-0x0000000003466000-memory.dmp
              Filesize

              41.4MB

              Download
            • memory/1308-55-0x000000001D920000-0x000000001D9A0000-memory.dmp
              Filesize

              512KB

              Download
            • memory/1308-56-0x000000001DAF0000-0x000000001DC46000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-58-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-57-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-60-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-62-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-64-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-68-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-66-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-70-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-72-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-74-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-80-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-78-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-76-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-82-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-86-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-88-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-84-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-90-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-92-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-96-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-94-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-98-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-100-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-102-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-104-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-106-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-108-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-114-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-112-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-110-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-116-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-118-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-120-0x000000001DAF0000-0x000000001DC40000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/1308-1893-0x000000001D920000-0x000000001D9A0000-memory.dmp
              Filesize

              512KB

              Download