Analysis

  • max time kernel
    135s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-11-2024 02:16

General

  • Target

    2a9851860e7d245eadc3004f986afc3cec8c7bf2fc967fdfbca1e0a96b864efa.exe

  • Size

    1.2MB

  • MD5

    754dceb944cf505a0957e70370a972ef

  • SHA1

    c16e4782f0f2f868deff74d4bc76b528162f1fcc

  • SHA256

    2a9851860e7d245eadc3004f986afc3cec8c7bf2fc967fdfbca1e0a96b864efa

  • SHA512

    ad1ace193fdc6ba8dba7c11dacc9afc5420efd7dc45a0994bec8d12952e806488b3156b8ec346e6f13b7f66e9b0890e65791eecb1ed574383ca73ed5ab2a4568

  • SSDEEP

    12288:3F81ciMbLepD06qWmVoos41xTTnKYli3CaKyA/Ds5iE1kxuZcsWBYQ/7o+No9eLd:uciMa06q2YpE2yA/DFPxuBWBZCA

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a9851860e7d245eadc3004f986afc3cec8c7bf2fc967fdfbca1e0a96b864efa.exe
    "C:\Users\Admin\AppData\Local\Temp\2a9851860e7d245eadc3004f986afc3cec8c7bf2fc967fdfbca1e0a96b864efa.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3628-0-0x00007FFDCF483000-0x00007FFDCF485000-memory.dmp

    Filesize

    8KB

  • memory/3628-1-0x0000000000DD0000-0x0000000000F0A000-memory.dmp

    Filesize

    1.2MB

  • memory/3628-2-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

    Filesize

    10.8MB

  • memory/3628-3-0x0000000001610000-0x000000000161E000-memory.dmp

    Filesize

    56KB

  • memory/3628-4-0x0000000001620000-0x000000000162E000-memory.dmp

    Filesize

    56KB

  • memory/3628-6-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

    Filesize

    10.8MB