Analysis
-
max time kernel
110s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
03-02-2025 09:34
General
-
Target
Архив WinRAR.rar
-
Size
14.4MB
-
MD5
b230ada2e5af0bc102993289fc5094e7
-
SHA1
a5504c19e4f2bd1dcd463892efa6a6b8cd98baca
-
SHA256
d4db97506ca75b2409068c9c423b26cf696f2335db6331b7795d4f96fb03e548
-
SHA512
8eb2e822a931af8517cd021f6699c2cd4d06e682cdfedd717eb6e7da9c9d16d45b5fe9735c85847a1f616b0ca9a3288b6edb5650b0f97efa178173f64c3226b8
-
SSDEEP
196608:j2VZ3M0dpen1lqvi1Ss4wjoCBvqtvCRtPvMMuTse1Wq/EWpHHCdNRwDLncZlW21T:ij8Ma1l9NoCBT/HMtT19/39HmNgcZVJr
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Архив WinRAR.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\fixes.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD53be6bf7c44a552d03e1d8e98de1001f0
SHA124879cd29b217458d4117ed0c2e98c804fcd3cdb
SHA256813b0bcd2265aa5edb210a844c96b7d2fb54c49cfa27950f199bd19e56b3f957
SHA5124ebd3ace1e00ee48410a0107e6aa557868f07b8f635e979d9b6b72cd5e710fd3137b6085a50fc80d77d2bd9477ebfd0aeef6596f6452de3a01d283f5deea7f06