Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-01-2025 23:12
General
-
Target
JaffaCakes118_3ffbc18d398e3754719b8546eeaf73b9.exe
-
Size
911KB
-
MD5
3ffbc18d398e3754719b8546eeaf73b9
-
SHA1
e8bf6d7be37f5201106b943c4cfdc5077970afc7
-
SHA256
4e2a6a635d17ed6ec63e30a53c03645488915ffa45ca5c309be5acdf72de2c70
-
SHA512
6ea20bfa1bb31ec29134adbac6736b8b1559c3cc2600a617de8401480b941f17e8649f210dadd07052be93a7e68966e4354affd32f7cc3a5e60821a0754cb35e
-
SSDEEP
12288:2VURM2L5m8UrpoeTgXS4mHUh+hqyDTIYwCBR4sHTHqpVlOqbAqn4:2VURrlm8Qqjtj+hqyD7wc4sCV0qbA+4
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3ffbc18d398e3754719b8546eeaf73b9.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3ffbc18d398e3754719b8546eeaf73b9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
936KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB