Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 03:11
Behavioral task
behavioral1
Sample
4CF21CF4FE938861269EEE0DCE7AB40A.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
4CF21CF4FE938861269EEE0DCE7AB40A.exe
Resource
win10v2004-20240508-en
General
-
Target
4CF21CF4FE938861269EEE0DCE7AB40A.exe
-
Size
1.1MB
-
MD5
4cf21cf4fe938861269eee0dce7ab40a
-
SHA1
8edccf6b4ce1a73419d25632d9707d1e473bfedc
-
SHA256
267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a
-
SHA512
c5cdf840d65ab2e78480c1a172250696860a70953dade41463352d47f89183c40c15d0672c9268fea68711eb432ff5167189de0bac90fc83b81d563a808f2879
-
SSDEEP
12288:VGcqjGumBv0SNdif3QKRDGUwUPECbyrdgDWaw6+DJKAC4FQAfJ4H1fZ2EsFDUzkj:IzmBv0vDGt3r6+yWJmgHgwSRADpDia
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Processes:
resource yara_rule behavioral2/memory/4116-1-0x0000000000EF0000-0x0000000001014000-memory.dmp dcrat -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
4CF21CF4FE938861269EEE0DCE7AB40A.exepid process 4116 4CF21CF4FE938861269EEE0DCE7AB40A.exe 4116 4CF21CF4FE938861269EEE0DCE7AB40A.exe 4116 4CF21CF4FE938861269EEE0DCE7AB40A.exe 4116 4CF21CF4FE938861269EEE0DCE7AB40A.exe 4116 4CF21CF4FE938861269EEE0DCE7AB40A.exe 4116 4CF21CF4FE938861269EEE0DCE7AB40A.exe 4116 4CF21CF4FE938861269EEE0DCE7AB40A.exe 4116 4CF21CF4FE938861269EEE0DCE7AB40A.exe 4116 4CF21CF4FE938861269EEE0DCE7AB40A.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4CF21CF4FE938861269EEE0DCE7AB40A.exedescription pid process Token: SeDebugPrivilege 4116 4CF21CF4FE938861269EEE0DCE7AB40A.exe