dcrat | 0b3af32b322e30f7f68017c13e59e71b6b1f26756477e122b40a20434bd01d01

Analysis

max time kernel
121s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 02:05

Target

0b3af32b322e30f7f68017c13e59e71b6b1f26756477e122b40a20434bd01d01.exe
Size

560KB
MD5

37cb065f052d8cf6a46d41d6225b9a9f
SHA1

ffcd01452c4b695f1371787a5c728c692283fca2
SHA256

0b3af32b322e30f7f68017c13e59e71b6b1f26756477e122b40a20434bd01d01
SHA512

8a2850f61af22a40ebb1e11c1d294cd74c94cf3b365619a4588bfbc54362575467cff4a5d75f685354b073453ad9892125739e78468a8dc550e52ccab88df47e
SSDEEP

6144:s/9Sb1sKhV/+NZCwUW/mulaEqLhEWRzSyAZW9z9mXbj7Gvvai33Ew8X6Asz6UrZ:sFK1DH/p8l/zWRdP5mfA33EjKf6UrZ

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

DCRat payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1940-1-0x0000000000C10000-0x0000000000CA2000-memory.dmp	family_dcrat_v2
behavioral1/files/0x000e00000001537c-13.dat	family_dcrat_v2
behavioral1/memory/2796-15-0x0000000000E40000-0x0000000000ED2000-memory.dmp	family_dcrat_v2

Executes dropped EXE 1 IoCs

pid	Process
2796	staticfile.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	0b3af32b322e30f7f68017c13e59e71b6b1f26756477e122b40a20434bd01d01.exe
Token: SeDebugPrivilege	2796	staticfile.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2944	1940	0b3af32b322e30f7f68017c13e59e71b6b1f26756477e122b40a20434bd01d01.exe	31
PID 1940 wrote to memory of 2944	1940	0b3af32b322e30f7f68017c13e59e71b6b1f26756477e122b40a20434bd01d01.exe	31
PID 1940 wrote to memory of 2944	1940	0b3af32b322e30f7f68017c13e59e71b6b1f26756477e122b40a20434bd01d01.exe	31
PID 2944 wrote to memory of 2356	2944	cmd.exe	33
PID 2944 wrote to memory of 2356	2944	cmd.exe	33
PID 2944 wrote to memory of 2356	2944	cmd.exe	33
PID 2944 wrote to memory of 2652	2944	cmd.exe	34
PID 2944 wrote to memory of 2652	2944	cmd.exe	34
PID 2944 wrote to memory of 2652	2944	cmd.exe	34
PID 2944 wrote to memory of 2796	2944	cmd.exe	35
PID 2944 wrote to memory of 2796	2944	cmd.exe	35
PID 2944 wrote to memory of 2796	2944	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\x4J7NyPzVK.bat

Filesize
219B

MD5
0ddd22f499f14dc8bb6be52e2c980c16

SHA1
529f9e515d065a5d3f003b07ee0de709726c2377

SHA256
38319bcc5998c505470378e6f6ef756fce742db306bb0ffbfd5cc95a95b9b7a4

SHA512
1bd408c1be6c3b51a446f2fd91414f69dbdb3c95e0dbd7776198a13e0f0d8cd3536d20f5a373bb81d59b8fac763e7fb254e377fcb1d3cbf53a549ca04218fb75

Download Submit
C:\Users\Admin\AppData\Local\staticfile.exe

Filesize
560KB

MD5
37cb065f052d8cf6a46d41d6225b9a9f

SHA1
ffcd01452c4b695f1371787a5c728c692283fca2

SHA256
0b3af32b322e30f7f68017c13e59e71b6b1f26756477e122b40a20434bd01d01

SHA512
8a2850f61af22a40ebb1e11c1d294cd74c94cf3b365619a4588bfbc54362575467cff4a5d75f685354b073453ad9892125739e78468a8dc550e52ccab88df47e

Download Submit
memory/1940-0-0x000007FEF55E3000-0x000007FEF55E4000-memory.dmp

Filesize
4KB

Download
memory/1940-1-0x0000000000C10000-0x0000000000CA2000-memory.dmp

Filesize
584KB

Download
memory/1940-2-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/1940-3-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download
memory/1940-4-0x0000000000150000-0x000000000015C000-memory.dmp

Filesize
48KB

Download
memory/1940-11-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2796-15-0x0000000000E40000-0x0000000000ED2000-memory.dmp

Filesize
584KB

Download