General
- Target 06f13a65bc1f66c683df0d1fb6dab168.exe
- Size 1.1MB
- Sample240106-dy66psfgdn
- SHA256 23f2af12d94f4f4ad3809c443a3d1bb286bfd47b2a10c7efe682c5222bae7fc2
Score
10/10
Malware Config
Targets
-
- Target 06f13a65bc1f66c683df0d1fb6dab168.exe
- Size 1.1MB
- SHA256 23f2af12d94f4f4ad3809c443a3d1bb286bfd47b2a10c7efe682c5222bae7fc2
Score10/10DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
UAC bypass
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
Checks whether UAC is enabled
Drops file in System32 directory
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1