dcrat | ec1f3a0c64bbd4848a74a1870a9e5499b9bfbeb1604d5fff2916dca5bf003a22

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/11/2024, 06:14

Target

ec1f3a0c64bbd4848a74a1870a9e5499b9bfbeb1604d5fff2916dca5bf003a22.exe
Size

1.2MB
MD5

f0a0864093df41cb85df01a16bc0bc5d
SHA1

4b88bc13c13a92bc9d7908db545e2903483bf022
SHA256

ec1f3a0c64bbd4848a74a1870a9e5499b9bfbeb1604d5fff2916dca5bf003a22
SHA512

037cbe49791dfee97d86db41138785360d21720f397f98701f65a5b11ac93bc48a83d54abc45c766e7c5d71c78ae361ebc4e18e16362e80e6eb8c7804a6366e3
SSDEEP

24576:FXjf6WYaN4kHhE5w0e1OKQREvixjVJAU9z0DTaBcvsgr3hoVnUOy0:pxaG1OZEvixjVJAU9z0zsggfh

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
behavioral1/memory/2668-1-0x0000000000E70000-0x0000000000FB4000-memory.dmp	dcrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2716	2668	ec1f3a0c64bbd4848a74a1870a9e5499b9bfbeb1604d5fff2916dca5bf003a22.exe	30
PID 2668 wrote to memory of 2716	2668	ec1f3a0c64bbd4848a74a1870a9e5499b9bfbeb1604d5fff2916dca5bf003a22.exe	30
PID 2668 wrote to memory of 2716	2668	ec1f3a0c64bbd4848a74a1870a9e5499b9bfbeb1604d5fff2916dca5bf003a22.exe	30

C:\Users\Admin\AppData\Local\Temp\ec1f3a0c64bbd4848a74a1870a9e5499b9bfbeb1604d5fff2916dca5bf003a22.exe
"C:\Users\Admin\AppData\Local\Temp\ec1f3a0c64bbd4848a74a1870a9e5499b9bfbeb1604d5fff2916dca5bf003a22.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2668 -s 636
  2⤵
  PID:2716

memory/2668-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/2668-1-0x0000000000E70000-0x0000000000FB4000-memory.dmp

Filesize
1.3MB

Download
memory/2668-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2668-3-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download