Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
17/08/2023, 18:36
General
-
Target
agentbrowser.exe
-
Size
947KB
-
MD5
9a84688aca96d89b149e213f6d059bfb
-
SHA1
043c929249d1dcbdddf4cfd278be4425f25bb644
-
SHA256
f8ee97725f7f1cdf37b5899e287c8497293e76ab372ee22bd9922ba3624e1b52
-
SHA512
c623def7e6276f72993e52c0ad603dbaaabbe85c4856c09c4a03f7180d333f16f5c159722c511e8ae8ccdc9a5d65d1d553b8686f13fdb9f336aaf41b39ef84b5
-
SSDEEP
12288:Xy0xAU7MjsetEfSDi22d7ysdcdvvO++zzYmn2Ybb7VqExqpGzX+UlzF9tpzJ:XAOMjsh722VyJXxCnzoEvzXPhJ
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\agentbrowser.exe"C:\Users\Admin\AppData\Local\Temp\agentbrowser.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
976KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
56KB
-
Filesize
9.9MB