Overview
overview
10Static
static
10Enigma32g.exe
windows7-x64
3Enigma32g.exe
windows10-2004-x64
3daytjhasdawd.exe
windows7-x64
10daytjhasdawd.exe
windows10-2004-x64
10ghdtawedtrgh.exe
windows7-x64
10ghdtawedtrgh.exe
windows10-2004-x64
10hsefawdrthg.exe
windows7-x64
10hsefawdrthg.exe
windows10-2004-x64
10hyfdaethfhfaed.exe
windows7-x64
3hyfdaethfhfaed.exe
windows10-2004-x64
5jdrgsotrti.exe
windows7-x64
10jdrgsotrti.exe
windows10-2004-x64
10jgurtgjasdth.exe
windows7-x64
10jgurtgjasdth.exe
windows10-2004-x64
10mfcthased.exe
windows7-x64
10mfcthased.exe
windows10-2004-x64
10mnftyjkrgjsae.exe
windows7-x64
10mnftyjkrgjsae.exe
windows10-2004-x64
10mtbkkesfthae.exe
windows7-x64
3mtbkkesfthae.exe
windows10-2004-x64
3tyhkamwdmrg.exe
windows7-x64
10tyhkamwdmrg.exe
windows10-2004-x64
10vovdawdrg.exe
windows7-x64
10vovdawdrg.exe
windows10-2004-x64
10Analysis
-
max time kernel
94s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 02:31
Behavioral task
behavioral1
Sample
Enigma32g.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
Enigma32g.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
daytjhasdawd.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
daytjhasdawd.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ghdtawedtrgh.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
ghdtawedtrgh.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
hsefawdrthg.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
hsefawdrthg.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
hyfdaethfhfaed.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
hyfdaethfhfaed.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
jdrgsotrti.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
jdrgsotrti.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
jgurtgjasdth.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
jgurtgjasdth.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
mfcthased.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
mfcthased.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
mnftyjkrgjsae.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
mnftyjkrgjsae.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
mtbkkesfthae.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
mtbkkesfthae.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
tyhkamwdmrg.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral22
Sample
tyhkamwdmrg.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
vovdawdrg.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
ghdtawedtrgh.exe
-
Size
889KB
-
MD5
ef75329efa1fa3cff64a2249e8b59306
-
SHA1
90db5c089347c52e7aeddbe97a652b0dc622b840
-
SHA256
6024771adfff13a50785d4bca819c583db42a5671d86bc6ac517c3620d931259
-
SHA512
73cf385ce56147f4c7862ef90cda59c947408dc0bf82c9d0c4b503bb53266d62763c79759235ee20e07b6e36cb50c123facab185d099e397daf0574eb586302f
-
SSDEEP
12288:kzw1NV5Il51mx6vEiss/VRqyAk9wiXPrQfkXmm1RhdLB9XirkVknCBz9eQFZz//q:kc8Xh/VAyAksEPLZj9H6t1
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
resource yara_rule behavioral6/memory/4148-1-0x0000000000D30000-0x0000000000E14000-memory.dmp family_dcrat_v2 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe 4148 ghdtawedtrgh.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4148 ghdtawedtrgh.exe