Overview

overview

10

Static

static

10

2516d63aa8...ab.exe

windows7-x64

10

2516d63aa8...ab.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2024 01:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe

  • Size

    888KB

  • MD5

    28aaa8f0b29a96138fd597975a16c5d4

  • SHA1

    b0ea5394610d089ab5248631a4c0f6666f79ffcd

  • SHA256

    2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab

  • SHA512

    7feafb633d698a96d81fae7069ebc2492caa253ade2106a645353096e7855e9cf33a69307f71f253ebbb5b957abab0de608860cc5efb7a2196720c269f8c231d

  • SSDEEP

    12288:wAl1WPQtkQNQ6yMs/Ua+iXPrQfkXmm1RhdLB9XirkVknCBz9eQFZz//qK4oV4g50:wwFp5yMs/UFEPLZj956t1

Score
10/10
dcratinfostealerrat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • DCRat payload 1 IoCs
    rat
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe
    "C:\Users\Admin\AppData\Local\Temp\2516d63aa8aef58d6f0a4e330bd87209872b0ff21a17cff5201a2d4783c5bfab.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1940-0-0x000007FEF54C3000-0x000007FEF54C4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1940-1-0x0000000001380000-0x0000000001464000-memory.dmp

    Filesize

    912KB

    Download

  • memory/1940-2-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1940-4-0x0000000000420000-0x000000000043C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1940-6-0x00000000004C0000-0x00000000004D8000-memory.dmp

    Filesize

    96KB

    Download

  • memory/1940-8-0x0000000000350000-0x000000000035C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1940-17-0x00000000004F0000-0x00000000004FC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1940-15-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1940-14-0x00000000004E0000-0x00000000004EC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1940-12-0x0000000000410000-0x000000000041E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1940-10-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1940-9-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1940-22-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1940-21-0x0000000000510000-0x000000000051C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1940-19-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1940-24-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1940-23-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

    Filesize

    9.9MB

    Download