Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

InstalIеr...vg.dll

windows7-x64

1

InstalIеr...vg.dll

windows10-2004-x64

1

InstalIеr...sg.dll

windows7-x64

1

InstalIеr...sg.dll

windows10-2004-x64

1

InstalIеr...kc.dll

windows7-x64

1

InstalIеr...kc.dll

windows10-2004-x64

1

InstalIеr...18.exe

windows7-x64

8

InstalIеr...18.exe

windows10-2004-x64

10

InstalIеr...ws.dll

windows7-x64

1

InstalIеr...ws.dll

windows10-2004-x64

1

InstalIеr...le.dll

windows7-x64

1

InstalIеr...le.dll

windows10-2004-x64

1

TT18.exe

windows7-x64

8

TT18.exe

windows10-2004-x64

10

TTDesktop18.exe

windows7-x64

8

TTDesktop18.exe

windows10-2004-x64

10

TikTokDesktop18.exe

windows7-x64

8

TikTokDesktop18.exe

windows10-2004-x64

10

adjthjawdth.exe

windows7-x64

10

adjthjawdth.exe

windows10-2004-x64

10

bxftjhksaef.exe

windows7-x64

10

bxftjhksaef.exe

windows10-2004-x64

10

cli.exe

windows7-x64

3

cli.exe

windows10-2004-x64

3

dujkgsf.exe

windows7-x64

3

dujkgsf.exe

windows10-2004-x64

5

fdaerghawd.exe

windows7-x64

7

fdaerghawd.exe

windows10-2004-x64

7

fkydjyhjadg.exe

windows7-x64

10

fkydjyhjadg.exe

windows10-2004-x64

10

fsyjawdr.exe

windows7-x64

10

fsyjawdr.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/11/2024, 21:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    adjthjawdth.exe

  • Size

    888KB

  • MD5

    28aaa8f0b29a96138fd597975a16c5d4

  • SHA1

    b0ea5394610d089ab5248631a4c0f6666f79ffcd

  • SHA256

    2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab

  • SHA512

    7feafb633d698a96d81fae7069ebc2492caa253ade2106a645353096e7855e9cf33a69307f71f253ebbb5b957abab0de608860cc5efb7a2196720c269f8c231d

  • SSDEEP

    12288:wAl1WPQtkQNQ6yMs/Ua+iXPrQfkXmm1RhdLB9XirkVknCBz9eQFZz//qK4oV4g50:wwFp5yMs/UFEPLZj956t1

Score
10/10
dcratinfostealerrat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • DCRat payload 1 IoCs
    rat
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\adjthjawdth.exe
    "C:\Users\Admin\AppData\Local\Temp\adjthjawdth.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2184-0-0x000007FEF5063000-0x000007FEF5064000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2184-1-0x0000000000F40000-0x0000000001024000-memory.dmp

    Filesize

    912KB

    Download

  • memory/2184-2-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2184-4-0x00000000006A0000-0x00000000006BC000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2184-7-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2184-11-0x0000000000690000-0x000000000069E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2184-14-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2184-16-0x0000000000A20000-0x0000000000A2C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2184-23-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2184-22-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2184-24-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2184-21-0x0000000000B40000-0x0000000000B4C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2184-19-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2184-18-0x0000000000B30000-0x0000000000B3E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2184-13-0x0000000000A10000-0x0000000000A1C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2184-9-0x0000000000680000-0x000000000068C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2184-6-0x00000000009F0000-0x0000000000A08000-memory.dmp

    Filesize

    96KB

    Download