Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15-11-2024 21:00

General

  • Target

    svhost.exe

  • Size

    1.2MB

  • MD5

    754dceb944cf505a0957e70370a972ef

  • SHA1

    c16e4782f0f2f868deff74d4bc76b528162f1fcc

  • SHA256

    2a9851860e7d245eadc3004f986afc3cec8c7bf2fc967fdfbca1e0a96b864efa

  • SHA512

    ad1ace193fdc6ba8dba7c11dacc9afc5420efd7dc45a0994bec8d12952e806488b3156b8ec346e6f13b7f66e9b0890e65791eecb1ed574383ca73ed5ab2a4568

  • SSDEEP

    12288:3F81ciMbLepD06qWmVoos41xTTnKYli3CaKyA/Ds5iE1kxuZcsWBYQ/7o+No9eLd:uciMa06q2YpE2yA/DFPxuBWBZCA

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\svhost.exe
    "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3432-0-0x00007FFE87FF3000-0x00007FFE87FF5000-memory.dmp

    Filesize

    8KB

  • memory/3432-1-0x0000000000150000-0x000000000028A000-memory.dmp

    Filesize

    1.2MB

  • memory/3432-2-0x00007FFE87FF0000-0x00007FFE88AB2000-memory.dmp

    Filesize

    10.8MB

  • memory/3432-3-0x00000000023C0000-0x00000000023CE000-memory.dmp

    Filesize

    56KB

  • memory/3432-4-0x00000000023D0000-0x00000000023DE000-memory.dmp

    Filesize

    56KB

  • memory/3432-6-0x00007FFE87FF0000-0x00007FFE88AB2000-memory.dmp

    Filesize

    10.8MB