Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
01-12-2024 02:21
Behavioral task
behavioral1
Sample
2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe
Resource
win7-20241023-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe
-
Size
888KB
-
MD5
28aaa8f0b29a96138fd597975a16c5d4
-
SHA1
b0ea5394610d089ab5248631a4c0f6666f79ffcd
-
SHA256
2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab
-
SHA512
7feafb633d698a96d81fae7069ebc2492caa253ade2106a645353096e7855e9cf33a69307f71f253ebbb5b957abab0de608860cc5efb7a2196720c269f8c231d
-
SSDEEP
12288:wAl1WPQtkQNQ6yMs/Ua+iXPrQfkXmm1RhdLB9XirkVknCBz9eQFZz//qK4oV4g50:wwFp5yMs/UFEPLZj956t1
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
resource yara_rule behavioral1/memory/2592-1-0x0000000001090000-0x0000000001174000-memory.dmp family_dcrat_v2 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2592 2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe