Analysis
-
max time kernel
17s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-11-2024 21:34
General
-
Target
b86f74d1f73a0f234843f87294835ea2f1df07760ffe1a9e8b8e9b61e088562aN.exe
-
Size
2.0MB
-
MD5
5f83951d810b486c36ca171cecf142d0
-
SHA1
dcb30b6d18fb8810882ff1d0ed2b61a8e70e5ed5
-
SHA256
b86f74d1f73a0f234843f87294835ea2f1df07760ffe1a9e8b8e9b61e088562a
-
SHA512
6c43abca1259de6a2eca5d41d5aff78c4435f57e23547002dbea6fd8caf0d206fd8ff386354392a7530cd7a196108a1c8bb5b522307b7a3f94154b39f0499b87
-
SSDEEP
24576:YOZGGptV5fRWyXchC98blumyLeUQUoJr3GBTSowqmGU12/Dje+qAcNZxOe2hc5cJ:YOZRptV5AbySUQUKzwLa1GG5AcNyN
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b86f74d1f73a0f234843f87294835ea2f1df07760ffe1a9e8b8e9b61e088562aN.exe"C:\Users\Admin\AppData\Local\Temp\b86f74d1f73a0f234843f87294835ea2f1df07760ffe1a9e8b8e9b61e088562aN.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
9.9MB