Analysis
-
max time kernel
115s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
05-02-2025 15:55
General
-
Target
a5291979129ded5f9d4e74deed3b2b68d8116f92cd5429ce47301cd727971b04N.exe
-
Size
2.0MB
-
MD5
9dacfc9d6a218957387e1beccc9bc670
-
SHA1
f52fb040aad686ff8bde1c5e7f4f382332a988a7
-
SHA256
a5291979129ded5f9d4e74deed3b2b68d8116f92cd5429ce47301cd727971b04
-
SHA512
062e71b6f27ed4feb004a5ecd2eb7b938f3aef18209bff0b6150a765c0eab6c30c4cc8a694735c4e0d033b8ffa222e199ae7699d4fae0c9d19d5d24d68201e9d
-
SSDEEP
24576:N3s6IAVPf6cr+jZRRGjzpRjns1NpJz8jEQ0tg284YVv9baETptpGntxvboFDQvWl:FjUQjzTbs1NpJzg0tg2G9bZpUt1mD
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Modifies registry class 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5291979129ded5f9d4e74deed3b2b68d8116f92cd5429ce47301cd727971b04N.exe"C:\Users\Admin\AppData\Local\Temp\a5291979129ded5f9d4e74deed3b2b68d8116f92cd5429ce47301cd727971b04N.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OIb7AQHNlT.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Recovery\WindowsRE\lsass.exe"C:\Recovery\WindowsRE\lsass.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD59dacfc9d6a218957387e1beccc9bc670
SHA1f52fb040aad686ff8bde1c5e7f4f382332a988a7
SHA256a5291979129ded5f9d4e74deed3b2b68d8116f92cd5429ce47301cd727971b04
SHA512062e71b6f27ed4feb004a5ecd2eb7b938f3aef18209bff0b6150a765c0eab6c30c4cc8a694735c4e0d033b8ffa222e199ae7699d4fae0c9d19d5d24d68201e9d
-
Filesize
159B
MD557a1326cec4c96f4b4269c650e8268e5
SHA1cc3896f37937d27473e029b6d26271b28d816fc4
SHA2567d7ec37a6a941a680d99ae3bfb749afb0fa903d3b32152845c551c7eeccdeed0
SHA51234f3dd3d1e75b9b64018ba2f99ba1ec62fcd2b8ee95f32733936368c83b4e2a51246cf3def9ccfa53b7c1f7cdd37037dac7b439785c0f03a50b2cf20114514a0
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
112KB
-
Filesize
320KB
-
Filesize
10.8MB
-
Filesize
48KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
820KB
-
Filesize
10.8MB
-
Filesize
1.9MB
-
Filesize
10.8MB
-
Filesize
820KB
-
Filesize
10.8MB