Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02-10-2024 01:43
General
-
Target
fb4256038010fac2182f060deffaa1ffe0ce66f55ad4ed328e30465522f9c79c.exe
-
Size
736KB
-
MD5
8dd93bb163b1658947ad6c63b79ad36f
-
SHA1
1d0ac0d640c7fcdf5f8641b8598777a42b9fecff
-
SHA256
fb4256038010fac2182f060deffaa1ffe0ce66f55ad4ed328e30465522f9c79c
-
SHA512
62956e65d74fc82c053314e6c9d2bde8efd036b0be8f5591161bde951eb7bc346b195e59289ebd466c18e7c0227619d6bd5b0314e7ed3d7415beaae03d3d5670
-
SSDEEP
12288:kATnF3pDw8Ji1OGaNeqALaJJMA+UiXPrQfkXmm1RhdLB9XGbHJnZ6:kATngKqqALEJMA+yEqX6
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb4256038010fac2182f060deffaa1ffe0ce66f55ad4ed328e30465522f9c79c.exe"C:\Users\Admin\AppData\Local\Temp\fb4256038010fac2182f060deffaa1ffe0ce66f55ad4ed328e30465522f9c79c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
760KB
-
Filesize
10.8MB
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
96KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB