Analysis
-
max time kernel
120s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22/03/2025, 06:11
General
-
Target
5737ca76a64d47bb4cca4745520c6e536f4b8360502070dfdacbd4ba1bb6ae88.exe
-
Size
2.0MB
-
MD5
18df4416b99e38d8f201ffff991464a8
-
SHA1
7607ea4dd4253214604250b52eef2fead9884fcf
-
SHA256
5737ca76a64d47bb4cca4745520c6e536f4b8360502070dfdacbd4ba1bb6ae88
-
SHA512
28917e821c575bc9671987b7b320900b850550a2c6b6a36396c1b21eddd0edaa6531e9f7c6d0185e7feed136eec5077e3afac438375f72ae814980f4c85f3b9f
-
SSDEEP
49152:7rYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:7dxVJC9UqRzsu+8N
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5737ca76a64d47bb4cca4745520c6e536f4b8360502070dfdacbd4ba1bb6ae88.exe"C:\Users\Admin\AppData\Local\Temp\5737ca76a64d47bb4cca4745520c6e536f4b8360502070dfdacbd4ba1bb6ae88.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
9.9MB