Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 19:45
Behavioral task
behavioral1
Sample
267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe
Resource
win10v2004-20240508-en
General
-
Target
267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe
-
Size
1.1MB
-
MD5
4cf21cf4fe938861269eee0dce7ab40a
-
SHA1
8edccf6b4ce1a73419d25632d9707d1e473bfedc
-
SHA256
267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a
-
SHA512
c5cdf840d65ab2e78480c1a172250696860a70953dade41463352d47f89183c40c15d0672c9268fea68711eb432ff5167189de0bac90fc83b81d563a808f2879
-
SSDEEP
12288:VGcqjGumBv0SNdif3QKRDGUwUPECbyrdgDWaw6+DJKAC4FQAfJ4H1fZ2EsFDUzkj:IzmBv0vDGt3r6+yWJmgHgwSRADpDia
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Processes:
resource yara_rule behavioral2/memory/1620-1-0x0000000000C30000-0x0000000000D54000-memory.dmp dcrat -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 ipinfo.io 18 ipinfo.io -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exepid process 1620 267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe 1620 267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe 1620 267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe 1620 267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe 1620 267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe 1620 267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe 1620 267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe 1620 267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe 1620 267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exepid process 1620 267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exedescription pid process Token: SeDebugPrivilege 1620 267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe"C:\Users\Admin\AppData\Local\Temp\267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1620