Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-01-2025 17:17
General
-
Target
3f9b0a52a8e3ecb7c3759c389d6649d5f3ace70aa6a204234746095c92286839.exe
-
Size
2.0MB
-
MD5
b6fbde76b7c18c0b9589583433503cbe
-
SHA1
3d281613d451750981da1bef4f44a6993c032451
-
SHA256
3f9b0a52a8e3ecb7c3759c389d6649d5f3ace70aa6a204234746095c92286839
-
SHA512
5baeb851da69c812bd85fc6ddbec1433c7f430616e9fe596262aafff0c1c3b28d4be419a3ca3f39541539e3ae249ba3c2ee99944b181563ac1b829336712b336
-
SSDEEP
49152:brYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTNw:bdxVJC9UqRzsu+8Nw
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f9b0a52a8e3ecb7c3759c389d6649d5f3ace70aa6a204234746095c92286839.exe"C:\Users\Admin\AppData\Local\Temp\3f9b0a52a8e3ecb7c3759c389d6649d5f3ace70aa6a204234746095c92286839.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
2.0MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
10.8MB