Analysis
-
max time kernel
37s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
06-08-2024 10:51
General
-
Target
31aee57f6f36d9c23e0b8d29f7416b4e.exe
-
Size
1.3MB
-
MD5
31aee57f6f36d9c23e0b8d29f7416b4e
-
SHA1
0e32711cbd9d7889152584adebc48064b902cf6b
-
SHA256
a6eb401f56e973135fb37f55a9ef749baa6bfdc814cafa5e29fa7f602431ce12
-
SHA512
35d454ae334d6e2674a2650983b2b2a99a85bc63dc81034f082ce3460bc2b3979c6109c9cf9bebcefb6bfc682a2ee30b5c7fe0177c63e58ea23f789b5b943e2e
-
SSDEEP
24576:74ByBirA6xpYcHcHEP9XoE9SP4yOuv2OZG6FIb93FGv:gAijYcHwcCmPeeOZJF+3F
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\31aee57f6f36d9c23e0b8d29f7416b4e.exe"C:\Users\Admin\AppData\Local\Temp\31aee57f6f36d9c23e0b8d29f7416b4e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
9.9MB
-
Filesize
112KB
-
Filesize
88KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
9.9MB