Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29/08/2024, 15:03
General
-
Target
3049dff59c007e4d95714d9e75a74a50e0ce1e012c0ea0e8dd0c4d457d99bf44.exe
-
Size
2.4MB
-
MD5
7e92b919f0d413c201afd73a1206a471
-
SHA1
d232d9e8c0d0bac4706a9ed3fcfb0c29f3411bb3
-
SHA256
3049dff59c007e4d95714d9e75a74a50e0ce1e012c0ea0e8dd0c4d457d99bf44
-
SHA512
637be3540335aa36da564d41eafb1f57b3ae975f17d977905b72a90572bf7beda660187887600e36cb0f1ff579eaaa95d1d7de4ebbd24bccc70d8e75bf1e1260
-
SSDEEP
49152:YnKY/LDpwDbG4PgI8l0muhENyOdPazXijeJ38T:Yb/Lie4oaZhE4ipe+T
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3049dff59c007e4d95714d9e75a74a50e0ce1e012c0ea0e8dd0c4d457d99bf44.exe"C:\Users\Admin\AppData\Local\Temp\3049dff59c007e4d95714d9e75a74a50e0ce1e012c0ea0e8dd0c4d457d99bf44.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
2.5MB
-
Filesize
10.8MB
-
Filesize
112KB
-
Filesize
344KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
88KB
-
Filesize
320KB
-
Filesize
48KB
-
Filesize
5.2MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
10.8MB