Analysis
-
max time kernel
83s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-12-2024 11:38
General
-
Target
e71708d1637b813f224ac113348c16a9be59cb1f3d0f3a8c2304441b5b77ef03N.exe
-
Size
2.0MB
-
MD5
74b319abea1aca31fcef9f947fce8310
-
SHA1
53981e89a73f6ae58fcf7c29949a5ba9fdadd052
-
SHA256
e71708d1637b813f224ac113348c16a9be59cb1f3d0f3a8c2304441b5b77ef03
-
SHA512
38ad20edcdd5ceb790da3dbf42c2fdea27be6e88c6d5998762f4f3d3cad6920942aa4ce8d1262f8cc3fd0252feb9d35335d4f58a1fc6ba38b0f138d14aec2e70
-
SSDEEP
49152:2vI62G31g6rFz6CtxYVICq18meUEYbac:2vI6Z1Lz68xYeCq18
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e71708d1637b813f224ac113348c16a9be59cb1f3d0f3a8c2304441b5b77ef03N.exe"C:\Users\Admin\AppData\Local\Temp\e71708d1637b813f224ac113348c16a9be59cb1f3d0f3a8c2304441b5b77ef03N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
9.9MB