Overview

overview

10

Static

static

10

2a58deb886...91.exe

windows7-x64

7

2a58deb886...91.exe

windows10-2004-x64

7

2a8a0bca04...56.exe

windows7-x64

1

2a8a0bca04...56.exe

windows10-2004-x64

1

2a9ffe006a...34.exe

windows7-x64

10

2a9ffe006a...34.exe

windows10-2004-x64

10

2ab11ad915...2a.exe

windows7-x64

8

2ab11ad915...2a.exe

windows10-2004-x64

8

2ac1621a2b...d2.exe

windows7-x64

7

2ac1621a2b...d2.exe

windows10-2004-x64

7

2b3308a415...7b.exe

windows7-x64

7

2b3308a415...7b.exe

windows10-2004-x64

7

2b3fba9224...50.exe

windows7-x64

10

2b3fba9224...50.exe

windows10-2004-x64

10

2b820e3de5...95.exe

windows7-x64

7

2b820e3de5...95.exe

windows10-2004-x64

7

2b9233e0b0...ed.exe

windows7-x64

7

2b9233e0b0...ed.exe

windows10-2004-x64

7

2bb7c2979e...c6.exe

windows7-x64

10

2bb7c2979e...c6.exe

windows10-2004-x64

8

2bcc16cd37...1b.exe

windows7-x64

7

2bcc16cd37...1b.exe

windows10-2004-x64

7

2bf6115ff0...e6.exe

windows7-x64

10

2bf6115ff0...e6.exe

windows10-2004-x64

10

2bfb9d98d1...aa.exe

windows7-x64

3

2bfb9d98d1...aa.exe

windows10-2004-x64

3

2c1bb67a63...62.exe

windows7-x64

10

2c1bb67a63...62.exe

windows10-2004-x64

10

2c878e31ca...a9.exe

windows7-x64

9

2c878e31ca...a9.exe

windows10-2004-x64

9

2ccb525855...c9.exe

windows7-x64

1

2ccb525855...c9.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    103s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:09 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2bf6115ff0a234d8ea278864c5abbbe6.exe

  • Size

    2.0MB

  • MD5

    2bf6115ff0a234d8ea278864c5abbbe6

  • SHA1

    c08a5d188cb9cb7f9da54f634fe20d3b1b8c8895

  • SHA256

    4ac0480a4604a1f0d3d488fc6d73d0599d0d389df241c89c62a0f574d0fbdf30

  • SHA512

    880bcf6cd4b55ddba6865a49702dbde7f77194996230d7294774e6880e2b9a18be634b4cc335d52b470bffb48fd6906bb3ccb229fe3927a4c4dab94861650a6d

  • SSDEEP

    49152:brYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:bdxVJC9UqRzsu+8N

Score
10/10
dcratinfostealerrat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bf6115ff0a234d8ea278864c5abbbe6.exe
    "C:\Users\Admin\AppData\Local\Temp\2bf6115ff0a234d8ea278864c5abbbe6.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5760

Network

  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388157_1F8FN0PPBBGQ5O2YF&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239339388157_1F8FN0PPBBGQ5O2YF&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 732063
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 125EE991B42240008049F1E4D79B9DC7 Ref B: LON04EDGE0610 Ref C: 2025-03-22T06:12:54Z
    date: Sat, 22 Mar 2025 06:12:54 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239354491534_1O3M85NN5LRG0CPTI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239354491534_1O3M85NN5LRG0CPTI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 449789
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 520F74E5F2E64FECBCB4C37ECF18A173 Ref B: LON04EDGE0610 Ref C: 2025-03-22T06:12:54Z
    date: Sat, 22 Mar 2025 06:12:54 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388158_1XCR56DJ2GD9T3UQ1&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239339388158_1XCR56DJ2GD9T3UQ1&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 729217
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 3786B03D4BCA4E87A442DD50467C5E71 Ref B: LON04EDGE0610 Ref C: 2025-03-22T06:12:54Z
    date: Sat, 22 Mar 2025 06:12:54 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239354491532_17IT0YRW2RNM8C8YH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239354491532_17IT0YRW2RNM8C8YH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 500116
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 897911251DC6435FA17A37B592EB0E4B Ref B: LON04EDGE0610 Ref C: 2025-03-22T06:12:54Z
    date: Sat, 22 Mar 2025 06:12:54 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418583_14V7XNG13AXXMHR4D&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418583_14V7XNG13AXXMHR4D&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 1145289
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 1C484EE816A84A1C99B53A754333ABDC Ref B: LON04EDGE0610 Ref C: 2025-03-22T06:12:55Z
    date: Sat, 22 Mar 2025 06:12:55 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418584_19MU177BXG1FCVM1K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418584_19MU177BXG1FCVM1K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
  • flag-us
    DNS
    c.pki.goog
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.180.3
  • flag-gb
    GET
    http://c.pki.goog/r/r1.crl
    Remote address:
    142.250.180.3:80
    Request
    GET /r/r1.crl HTTP/1.1
    Cache-Control: max-age = 3000
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 304 Not Modified
    Date: Sat, 22 Mar 2025 05:59:32 GMT
    Expires: Sat, 22 Mar 2025 06:49:32 GMT
    Age: 813
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Cache-Control: public, max-age=3000
    Vary: Accept-Encoding
  • 150.171.27.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239340418584_19MU177BXG1FCVM1K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    tls, http2
    107.2kB
     3.1MB
     2256
    2249

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388157_1F8FN0PPBBGQ5O2YF&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239354491534_1O3M85NN5LRG0CPTI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388158_1XCR56DJ2GD9T3UQ1&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239354491532_17IT0YRW2RNM8C8YH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418583_14V7XNG13AXXMHR4D&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418584_19MU177BXG1FCVM1K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.1kB
     6.9kB
     14
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.1kB
     6.9kB
     14
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     7.0kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.8kB
     8.3kB
     17
    13
  • 142.250.180.3:80
    http://c.pki.goog/r/r1.crl
    http
    660 B
     394 B
     10
    4

    HTTP Request

    GET http://c.pki.goog/r/r1.crl

    HTTP Response

    304
  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     170 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    c.pki.goog
    dns
    56 B
     107 B
     1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.180.3

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5760-0-0x00007FFD4A613000-0x00007FFD4A615000-memory.dmp

    Filesize

    8KB

    Download

  • memory/5760-1-0x0000000000960000-0x0000000000B6A000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/5760-2-0x00007FFD4A610000-0x00007FFD4B0D1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5760-3-0x0000000002D90000-0x0000000002D9E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/5760-4-0x0000000002DA0000-0x0000000002DAE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/5760-6-0x00007FFD4A610000-0x00007FFD4B0D1000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.