Analysis
-
max time kernel
0s -
max time network
4s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10-03-2024 02:10
General
-
Target
fd5a129b2c633638de8eb0ee7ba6e09409792634013716728b9059ec8d8a9c1d.exe
-
Size
2.0MB
-
MD5
3b087674f0e8b7234f728acab016e8f5
-
SHA1
5e1f884d4e368c0825c528e17b6dca68dbb941db
-
SHA256
fd5a129b2c633638de8eb0ee7ba6e09409792634013716728b9059ec8d8a9c1d
-
SHA512
e590dca4fbbd016cb652e471d260b2d378eb9d51e8e507112eef66fb667e9832021234c55b74d8716bcb9dc95c574fe1bc8078eb8f8936b4365e29ce8711b9f0
-
SSDEEP
49152:pxH/vjAjxrp0wb6Bka0jvbpznuY05nlDuPW1uY:DHcjxt0wb6qrjNzkP6PquY
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd5a129b2c633638de8eb0ee7ba6e09409792634013716728b9059ec8d8a9c1d.exe"C:\Users\Admin\AppData\Local\Temp\fd5a129b2c633638de8eb0ee7ba6e09409792634013716728b9059ec8d8a9c1d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
10.8MB
-
Filesize
64KB