Analysis
-
max time kernel
121s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
24/02/2024, 23:13
General
-
Target
injector.exe
-
Size
759KB
-
MD5
cade10326d0e34723a90beca2ead0dca
-
SHA1
33397952d143d97a5002b7fd2ba33e7905a90743
-
SHA256
5c6408ee9865b3d814042cda1212b4a54f78f3101aabbbaf6a61d622c75cde82
-
SHA512
a18a20fa641560702b26d0b678e2df557ff7d4b6e6ca2174e83d85afe23c4eec9912acf91377ecac974878b958a13b5b95e5f45b1042e9c5202fb2fc3b62981e
-
SSDEEP
12288:to6Uu6KD3bnCA3t246nRZlVgbDw+ZTCE9dggeaVDJqkfapYDMgjnl2crVYxbZKJR:yi6KKA32/lV8nqTOw+pTh
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\injector.exe"C:\Users\Admin\AppData\Local\Temp\injector.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
656KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
112KB
-
Filesize
88KB
-
Filesize
6.9MB
-
Filesize
256KB