Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-11-2024 15:10
General
-
Target
d042c4e001560b967725219c919361e46ac04c64b158f533b94001fe46c6b9e5N.exe
-
Size
2.0MB
-
MD5
706b5d23db205e05904a78856c6075e0
-
SHA1
3600b5adbb216534a207878dd87da918aa37530f
-
SHA256
d042c4e001560b967725219c919361e46ac04c64b158f533b94001fe46c6b9e5
-
SHA512
670b0dcfb4df116ee3fb3f553e105789b3565d276856a8fdcda56b78ae3c88f39115feac36107bd8c6322b316c0ec7b93a89f39402d6fb6b07b29709c12bf831
-
SSDEEP
24576:QOZGGptV5fRWyXchC98blumyLeUQUoJr3GBTSowqmGU12/Dje+qAcNZxOe2hc5cJ:QOZRptV5AbySUQUKzwLa1GG5AcNyN
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d042c4e001560b967725219c919361e46ac04c64b158f533b94001fe46c6b9e5N.exe"C:\Users\Admin\AppData\Local\Temp\d042c4e001560b967725219c919361e46ac04c64b158f533b94001fe46c6b9e5N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
2.0MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
10.8MB