Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-11-2024 21:00

General

  • Target

    svhost.exe

  • Size

    1.2MB

  • MD5

    754dceb944cf505a0957e70370a972ef

  • SHA1

    c16e4782f0f2f868deff74d4bc76b528162f1fcc

  • SHA256

    2a9851860e7d245eadc3004f986afc3cec8c7bf2fc967fdfbca1e0a96b864efa

  • SHA512

    ad1ace193fdc6ba8dba7c11dacc9afc5420efd7dc45a0994bec8d12952e806488b3156b8ec346e6f13b7f66e9b0890e65791eecb1ed574383ca73ed5ab2a4568

  • SSDEEP

    12288:3F81ciMbLepD06qWmVoos41xTTnKYli3CaKyA/Ds5iE1kxuZcsWBYQ/7o+No9eLd:uciMa06q2YpE2yA/DFPxuBWBZCA

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\svhost.exe
    "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2848-0-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

    Filesize

    4KB

  • memory/2848-1-0x0000000000AF0000-0x0000000000C2A000-memory.dmp

    Filesize

    1.2MB

  • memory/2848-2-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

    Filesize

    9.9MB

  • memory/2848-3-0x00000000003C0000-0x00000000003CE000-memory.dmp

    Filesize

    56KB

  • memory/2848-4-0x00000000003D0000-0x00000000003DE000-memory.dmp

    Filesize

    56KB

  • memory/2848-5-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

    Filesize

    9.9MB