Overview

overview

10

Static

static

10

Enigma32g.exe

windows10-2004-x64

3

daytjhasdawd.exe

windows10-2004-x64

10

ghdtawedtrgh.exe

windows10-2004-x64

10

hsefawdrthg.exe

windows10-2004-x64

10

hyfdaethfhfaed.exe

windows10-2004-x64

5

jdrgsotrti.exe

windows10-2004-x64

10

jgurtgjasdth.exe

windows10-2004-x64

10

mfcthased.exe

windows10-2004-x64

10

mnftyjkrgjsae.exe

windows10-2004-x64

10

mtbkkesfthae.exe

windows10-2004-x64

8

tyhkamwdmrg.exe

windows10-2004-x64

10

vovdawdrg.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • submitted
    02-12-2024 00:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ghdtawedtrgh.exe

Score
10/10
dcratinfostealerrat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • DCRat payload 1 IoCs
    rat
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ghdtawedtrgh.exe
    "C:\Users\Admin\AppData\Local\Temp\ghdtawedtrgh.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4508-0-0x00007FFF59F73000-0x00007FFF59F75000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4508-1-0x0000000000320000-0x0000000000404000-memory.dmp

    Filesize

    912KB

    Download

  • memory/4508-2-0x00007FFF59F70000-0x00007FFF5AA31000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4508-4-0x0000000002490000-0x00000000024AC000-memory.dmp

    Filesize

    112KB

    Download

  • memory/4508-7-0x00000000024B0000-0x00000000024C8000-memory.dmp

    Filesize

    96KB

    Download

  • memory/4508-5-0x0000000002510000-0x0000000002560000-memory.dmp

    Filesize

    320KB

    Download

  • memory/4508-9-0x0000000002470000-0x000000000247C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/4508-11-0x00000000024D0000-0x00000000024DE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4508-13-0x00000000024E0000-0x00000000024EC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/4508-15-0x00000000024F0000-0x00000000024FC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/4508-17-0x00000000025A0000-0x00000000025AE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4508-20-0x00007FFF59F70000-0x00007FFF5AA31000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4508-19-0x00000000025B0000-0x00000000025BC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/4508-22-0x00007FFF59F70000-0x00007FFF5AA31000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4508-23-0x00007FFF59F70000-0x00007FFF5AA31000-memory.dmp

    Filesize

    10.8MB

    Download