Analysis
- max time kernel
37s - max time network
154s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
- submitted
06/08/2024, 10:51
General
- Target 31aee57f6f36d9c23e0b8d29f7416b4e.exe
- Size 1.3MB
- Sample240806-mxtcws1eja
- SHA256 a6eb401f56e973135fb37f55a9ef749baa6bfdc814cafa5e29fa7f602431ce12
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\31aee57f6f36d9c23e0b8d29f7416b4e.exe"C:\Users\Admin\AppData\Local\Temp\31aee57f6f36d9c23e0b8d29f7416b4e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2520-0-0x000007FEF5DB3000-0x000007FEF5DB4000-memory.dmp
memory/2520-1-0x00000000010D0000-0x0000000001222000-memory.dmp
memory/2520-2-0x000007FEF5DB0000-0x000007FEF679C000-memory.dmp
memory/2520-3-0x00000000003D0000-0x00000000003EC000-memory.dmp
memory/2520-4-0x00000000003F0000-0x0000000000406000-memory.dmp
memory/2520-5-0x0000000000410000-0x0000000000422000-memory.dmp
memory/2520-6-0x0000000000BF0000-0x0000000000BF8000-memory.dmp
memory/2520-7-0x0000000000C00000-0x0000000000C0E000-memory.dmp
memory/2520-8-0x000007FEF5DB3000-0x000007FEF5DB4000-memory.dmp
memory/2520-9-0x000007FEF5DB0000-0x000007FEF679C000-memory.dmp