Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-01-2025 16:59
General
-
Target
ff10a8686f000a107026bf58d56c5534e432ad7133f6dfb48c96552215612a18N.exe
-
Size
2.0MB
-
MD5
a66b3ee0cfb0281ec2b61546a98241d0
-
SHA1
ad3a9b0f3fa1674ad800ec167ac29205abbaf1e2
-
SHA256
ff10a8686f000a107026bf58d56c5534e432ad7133f6dfb48c96552215612a18
-
SHA512
a28dbba44a658507d4fbae9a78c6e61e17f860064eb93705cb8b4b5834fe7e69e025bdb8fb9b56dbcd9c469d5e20dd7b629d82b988470a48a4e896900f7be421
-
SSDEEP
49152:brYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:bdxVJC9UqRzsu+8N
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff10a8686f000a107026bf58d56c5534e432ad7133f6dfb48c96552215612a18N.exe"C:\Users\Admin\AppData\Local\Temp\ff10a8686f000a107026bf58d56c5534e432ad7133f6dfb48c96552215612a18N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
9.9MB