Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2024 21:44
Behavioral task
behavioral1
Sample
baedawdgh.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
gdwadtyjuesfshas.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
gweadtrgh.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
hjgesadfseawd.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
kisloyat.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
kisteruop.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
pothjmawdtrg.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
hjgesadfseawd.exe
-
Size
889KB
-
MD5
ef75329efa1fa3cff64a2249e8b59306
-
SHA1
90db5c089347c52e7aeddbe97a652b0dc622b840
-
SHA256
6024771adfff13a50785d4bca819c583db42a5671d86bc6ac517c3620d931259
-
SHA512
73cf385ce56147f4c7862ef90cda59c947408dc0bf82c9d0c4b503bb53266d62763c79759235ee20e07b6e36cb50c123facab185d099e397daf0574eb586302f
-
SSDEEP
12288:kzw1NV5Il51mx6vEiss/VRqyAk9wiXPrQfkXmm1RhdLB9XirkVknCBz9eQFZz//q:kc8Xh/VAyAksEPLZj9H6t1
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/2616-1-0x0000000000C40000-0x0000000000D24000-memory.dmp family_dcrat_v2 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
hjgesadfseawd.exepid Process 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe 2616 hjgesadfseawd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
hjgesadfseawd.exedescription pid Process Token: SeDebugPrivilege 2616 hjgesadfseawd.exe