Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    15-11-2024 21:05

General

  • Target

    svhost.exe

  • Size

    1.2MB

  • MD5

    754dceb944cf505a0957e70370a972ef

  • SHA1

    c16e4782f0f2f868deff74d4bc76b528162f1fcc

  • SHA256

    2a9851860e7d245eadc3004f986afc3cec8c7bf2fc967fdfbca1e0a96b864efa

  • SHA512

    ad1ace193fdc6ba8dba7c11dacc9afc5420efd7dc45a0994bec8d12952e806488b3156b8ec346e6f13b7f66e9b0890e65791eecb1ed574383ca73ed5ab2a4568

  • SSDEEP

    12288:3F81ciMbLepD06qWmVoos41xTTnKYli3CaKyA/Ds5iE1kxuZcsWBYQ/7o+No9eLd:uciMa06q2YpE2yA/DFPxuBWBZCA

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\svhost.exe
    "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1396-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

    Filesize

    4KB

  • memory/1396-1-0x0000000000F60000-0x000000000109A000-memory.dmp

    Filesize

    1.2MB

  • memory/1396-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

    Filesize

    9.9MB

  • memory/1396-3-0x0000000000310000-0x000000000031E000-memory.dmp

    Filesize

    56KB

  • memory/1396-4-0x0000000000320000-0x000000000032E000-memory.dmp

    Filesize

    56KB

  • memory/1396-5-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

    Filesize

    9.9MB