Resubmissions
13/10/2023, 20:40
231013-zfvwlsab95 10Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13/10/2023, 20:40
General
-
Target
NEAS.cbddc12efb35b167d9bf89ec8aedbac0.exe
-
Size
2.3MB
-
MD5
cbddc12efb35b167d9bf89ec8aedbac0
-
SHA1
caa75e130c53e4a9b4dae297fc63085bbd204e91
-
SHA256
02a2b3e40710f15c97b9f90e99bd14bdab3df5833c74d511c2ea8ebb0177f279
-
SHA512
4dc88c280fd1d7bd1d1a33236703c1ef15f610b2b311c72190dd6ef041773bc1bee1ca4fdecb76298d437a7105e7779dc1a1c76353932b8e09d3fa141065c131
-
SSDEEP
49152:39JJfWb3z7NWrRAMh8l9M9VnnoHszsLvDFH9TX:39TWb+RAMh8l9MYHusnV9L
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cbddc12efb35b167d9bf89ec8aedbac0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cbddc12efb35b167d9bf89ec8aedbac0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
112KB
-
Filesize
320KB
-
Filesize
88KB
-
Filesize
344KB
-
Filesize
72KB
-
Filesize
5.2MB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB