Analysis
-
max time kernel
94s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-11-2024 21:50
General
-
Target
hjgesadfseawd.exe
-
Size
889KB
-
MD5
ef75329efa1fa3cff64a2249e8b59306
-
SHA1
90db5c089347c52e7aeddbe97a652b0dc622b840
-
SHA256
6024771adfff13a50785d4bca819c583db42a5671d86bc6ac517c3620d931259
-
SHA512
73cf385ce56147f4c7862ef90cda59c947408dc0bf82c9d0c4b503bb53266d62763c79759235ee20e07b6e36cb50c123facab185d099e397daf0574eb586302f
-
SSDEEP
12288:kzw1NV5Il51mx6vEiss/VRqyAk9wiXPrQfkXmm1RhdLB9XirkVknCBz9eQFZz//q:kc8Xh/VAyAksEPLZj9H6t1
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\hjgesadfseawd.exe"C:\Users\Admin\AppData\Local\Temp\hjgesadfseawd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
912KB
-
Filesize
10.8MB
-
Filesize
112KB
-
Filesize
320KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
48KB
-
Filesize
10.8MB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
48KB
-
Filesize
10.8MB
-
Filesize
10.8MB