Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-11-2024 12:04
General
-
Target
5a05e48d6a807fe20bc551ee6915826afe2793e57aa9470606302e5d70b3be90.exe
-
Size
911KB
-
MD5
fb396e8fb44e07d9837437815b0cf47b
-
SHA1
64ada79f22ab7282255568c457cc271b8336a5ae
-
SHA256
5a05e48d6a807fe20bc551ee6915826afe2793e57aa9470606302e5d70b3be90
-
SHA512
eb8069ca9efd96d1329bb9e74eec753f4a315836e5daf6c29cf9eb68c5e554ceedaf329fb62cc556a7eb4b3518064acf3e917c3ad39ed24f1efca24ecd6aa38b
-
SSDEEP
12288:2VURM2L5m8UrpoeTgXS4mHUh+hqyDTIYwCBR4sHTHqpVlOqbAqn4b:2VURrlm8Qqjtj+hqyD7wc4sCV0qbA+4b
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a05e48d6a807fe20bc551ee6915826afe2793e57aa9470606302e5d70b3be90.exe"C:\Users\Admin\AppData\Local\Temp\5a05e48d6a807fe20bc551ee6915826afe2793e57aa9470606302e5d70b3be90.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
936KB
-
Filesize
9.9MB
-
Filesize
9.9MB