Overview

overview

10

Static

static

10

2516d63aa8...ab.exe

windows7-x64

10

2516d63aa8...ab.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2024 02:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe

  • Size

    888KB

  • MD5

    28aaa8f0b29a96138fd597975a16c5d4

  • SHA1

    b0ea5394610d089ab5248631a4c0f6666f79ffcd

  • SHA256

    2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab

  • SHA512

    7feafb633d698a96d81fae7069ebc2492caa253ade2106a645353096e7855e9cf33a69307f71f253ebbb5b957abab0de608860cc5efb7a2196720c269f8c231d

  • SSDEEP

    12288:wAl1WPQtkQNQ6yMs/Ua+iXPrQfkXmm1RhdLB9XirkVknCBz9eQFZz//qK4oV4g50:wwFp5yMs/UFEPLZj956t1

Score
10/10
dcratinfostealerrat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • DCRat payload 1 IoCs
    rat
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe
    "C:\Users\Admin\AppData\Local\Temp\2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4504-0-0x00007FFCFD083000-0x00007FFCFD085000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4504-1-0x0000000000180000-0x0000000000264000-memory.dmp

    Filesize

    912KB

    Download

  • memory/4504-2-0x00007FFCFD080000-0x00007FFCFDB41000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4504-4-0x0000000000B70000-0x0000000000B8C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/4504-5-0x00000000023C0000-0x0000000002410000-memory.dmp

    Filesize

    320KB

    Download

  • memory/4504-7-0x0000000000B90000-0x0000000000BA8000-memory.dmp

    Filesize

    96KB

    Download

  • memory/4504-10-0x00007FFCFD080000-0x00007FFCFDB41000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4504-9-0x0000000000B30000-0x0000000000B3C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/4504-12-0x0000000000B50000-0x0000000000B5E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4504-14-0x0000000000B60000-0x0000000000B6C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/4504-16-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/4504-18-0x00000000023B0000-0x00000000023BE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4504-20-0x0000000002410000-0x000000000241C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/4504-21-0x00007FFCFD080000-0x00007FFCFDB41000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4504-24-0x00007FFCFD080000-0x00007FFCFDB41000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4504-23-0x00007FFCFD080000-0x00007FFCFDB41000-memory.dmp

    Filesize

    10.8MB

    Download