Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-12-2024 19:12
General
-
Target
1fe64dc279ae19ae0c4bc0ca002c462ab5d2eff45fc6d74dbd4ac3286fd395b9N.exe
-
Size
2.0MB
-
MD5
c302419e150da41c59537eb1afa06cb0
-
SHA1
8f90e3d528fd8307d402831f3405df9171d612b4
-
SHA256
1fe64dc279ae19ae0c4bc0ca002c462ab5d2eff45fc6d74dbd4ac3286fd395b9
-
SHA512
b0ad455ce5171530d334c642b30d2fe5a3e06e9d702ba80404a098bc50a9af261de523e48bdab69b9fbdadfb4c2aeaa964490675afee1caf20b9c0eb10401f94
-
SSDEEP
49152:jrYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:jdxVJC9UqRzsu+8N
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fe64dc279ae19ae0c4bc0ca002c462ab5d2eff45fc6d74dbd4ac3286fd395b9N.exe"C:\Users\Admin\AppData\Local\Temp\1fe64dc279ae19ae0c4bc0ca002c462ab5d2eff45fc6d74dbd4ac3286fd395b9N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
2.0MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
10.8MB