Overview

overview

10

Static

static

10

InstalIеr...18.exe

windows10-2004-x64

10

TT18.exe

windows10-2004-x64

10

TTDesktop18.exe

windows10-2004-x64

10

TikTokDesktop18.exe

windows10-2004-x64

10

adjthjawdth.exe

windows10-2004-x64

10

bxftjhksaef.exe

windows10-2004-x64

10

cli.exe

windows10-2004-x64

3

dujkgsf.exe

windows10-2004-x64

5

fdaerghawd.exe

windows10-2004-x64

7

fkydjyhjadg.exe

windows10-2004-x64

10

fsyjawdr.exe

windows10-2004-x64

10

gjawedrtg.exe

windows10-2004-x64

10

hfaewdth.exe

windows10-2004-x64

10

jgesfyhjsefa.exe

windows10-2004-x64

10

jhnykawfkth.exe

windows10-2004-x64

10

kfhtksfesek.exe

windows10-2004-x64

10

kohjaekdfth.exe

windows10-2004-x64

7

krgawdtyjawd.exe

windows10-2004-x64

10

kthkksefd.exe

windows10-2004-x64

10

kyhjasehs.exe

windows10-2004-x64

10

kyjjrfgjjsedf.exe

windows10-2004-x64

7

lfcdgbuksf.exe

windows10-2004-x64

10

lkyhjksefa.exe

windows10-2004-x64

10

lyjdfjthawd.exe

windows10-2004-x64

10

nbothjkd.exe

windows10-2004-x64

10

nhbjsekfkjtyhja.exe

windows10-2004-x64

10

nothjgdwa.exe

windows10-2004-x64

7

nthnaedltg.exe

windows10-2004-x64

10

pghsefyjhsef.exe

windows10-2004-x64

10

pyjnkasedf.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    112s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2024 21:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    adjthjawdth.exe

  • Size

    888KB

  • MD5

    28aaa8f0b29a96138fd597975a16c5d4

  • SHA1

    b0ea5394610d089ab5248631a4c0f6666f79ffcd

  • SHA256

    2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab

  • SHA512

    7feafb633d698a96d81fae7069ebc2492caa253ade2106a645353096e7855e9cf33a69307f71f253ebbb5b957abab0de608860cc5efb7a2196720c269f8c231d

  • SSDEEP

    12288:wAl1WPQtkQNQ6yMs/Ua+iXPrQfkXmm1RhdLB9XirkVknCBz9eQFZz//qK4oV4g50:wwFp5yMs/UFEPLZj956t1

Score
10/10
dcratinfostealerrat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • DCRat payload 1 IoCs
    rat
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\adjthjawdth.exe
    "C:\Users\Admin\AppData\Local\Temp\adjthjawdth.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2140-0-0x00007FFC7BC93000-0x00007FFC7BC95000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2140-1-0x0000000000890000-0x0000000000974000-memory.dmp

    Filesize

    912KB

    Download

  • memory/2140-2-0x00007FFC7BC90000-0x00007FFC7C751000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2140-4-0x0000000002AF0000-0x0000000002B0C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2140-6-0x00007FFC7BC90000-0x00007FFC7C751000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2140-10-0x0000000002AE0000-0x0000000002AEC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2140-12-0x0000000002B30000-0x0000000002B3E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2140-14-0x0000000002B40000-0x0000000002B4C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2140-15-0x00007FFC7BC90000-0x00007FFC7C751000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2140-8-0x0000000002B10000-0x0000000002B28000-memory.dmp

    Filesize

    96KB

    Download

  • memory/2140-19-0x000000001B4E0000-0x000000001B4EE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2140-17-0x0000000002B50000-0x0000000002B5C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2140-21-0x000000001B4F0000-0x000000001B4FC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2140-22-0x00007FFC7BC90000-0x00007FFC7C751000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2140-5-0x000000001B490000-0x000000001B4E0000-memory.dmp

    Filesize

    320KB

    Download

  • memory/2140-24-0x00007FFC7BC90000-0x00007FFC7C751000-memory.dmp

    Filesize

    10.8MB

    Download