Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/03/2025, 06:08
General
-
Target
22e982850d21652c4a32b8c048f19b20.exe
-
Size
2.0MB
-
MD5
22e982850d21652c4a32b8c048f19b20
-
SHA1
f72a3ab745d1a1113965bb89a342525f30d12408
-
SHA256
a2f1356aa5651bea6110c7820ed856d54b26c8757af7a968383f167a46051c87
-
SHA512
10c1db49c4bfa962c88b08764cc581bbaf34cf8ef9ef6ea106e6cd57b529fe588d1d3f6d70596b63224acc7f9efb06450bf5a0c3a23a88d60f00a96bf512641f
-
SSDEEP
49152:TrYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:TdxVJC9UqRzsu+8N
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\22e982850d21652c4a32b8c048f19b20.exe"C:\Users\Admin\AppData\Local\Temp\22e982850d21652c4a32b8c048f19b20.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
9.9MB