Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-01-2025 23:41
General
-
Target
d088e4aa4164635b0c63f5306407d54405f150a16d9e54ebc9e1f5fdce38ca3fN.exe
-
Size
3.0MB
-
MD5
73ed08c35ee79bd5b651c9d3e5016380
-
SHA1
e933b35c96d4a08a565886ca1a82247c051066f5
-
SHA256
d088e4aa4164635b0c63f5306407d54405f150a16d9e54ebc9e1f5fdce38ca3f
-
SHA512
4bb46e3da9bdd0808fc688a1edc1194022f0100690de2275a55b34c3fe399b3b3810293ecd6a557687a77dc14031e3266344b2a55b986405c08c6361ef53604d
-
SSDEEP
49152:qZ0ze+xipcccv1lvfLjTOPJBmPFT+6kobj1GUz/lgVgqnQ2M10VilX1:iKew44LjTOhcFTd1bj1V/lUFQf10ViF
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d088e4aa4164635b0c63f5306407d54405f150a16d9e54ebc9e1f5fdce38ca3fN.exe"C:\Users\Admin\AppData\Local\Temp\d088e4aa4164635b0c63f5306407d54405f150a16d9e54ebc9e1f5fdce38ca3fN.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
3.0MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
10.8MB