Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
14-10-2023 19:15
General
-
Target
NEAS.d458a7bf0db646de14e34da2165abf60.exe
-
Size
1.9MB
-
MD5
d458a7bf0db646de14e34da2165abf60
-
SHA1
df530e6ddfccd3d2dd4bc5f169f9c9a80caec5ff
-
SHA256
a330b490e801bf1add3aabeea77ec9c3320da52fcd1c6a966b103d7ab563a5d5
-
SHA512
8e5df0ea7ed21b3b8b45353edaec66d587d5753953c016e2f2755ed3c9c6361eb8189fec7c2530b78a94fa86cb8b1194acbf602b626acabcbb8a66599f7be4a5
-
SSDEEP
49152:/p5Qe5JmY0JsFyApbFZf/GryS3x/F4A5UIh:7d5r0KFTGrBFpU
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d458a7bf0db646de14e34da2165abf60.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d458a7bf0db646de14e34da2165abf60.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
512KB
-
Filesize
56KB
-
Filesize
9.9MB