Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 08:59
General
-
Target
ee01d40501dd3b612d3e65ceca0c0180175f42596df1cc37d35abae9bc816889.exe
-
Size
2.0MB
-
MD5
6b88d4b6c995c360e2f2138faa231794
-
SHA1
8feb9520e5ea882bc9d0db0fdd711c103f9f4a5b
-
SHA256
ee01d40501dd3b612d3e65ceca0c0180175f42596df1cc37d35abae9bc816889
-
SHA512
22349bf4b9da2b3df508a9b65716b17a0383777f9a1e66e94355de1b46e1d19a743fba9b16285399eba37e46491af205c21bdf83adf439bc13308b33351c5592
-
SSDEEP
49152:JQOavWHvEToeWC7ZdEWrsELqT/wcSNWbK1aha:JLTHvEToeWELTWwbx
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee01d40501dd3b612d3e65ceca0c0180175f42596df1cc37d35abae9bc816889.exe"C:\Users\Admin\AppData\Local\Temp\ee01d40501dd3b612d3e65ceca0c0180175f42596df1cc37d35abae9bc816889.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
2.0MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
10.8MB