Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/03/2025, 06:11
General
-
Target
55e68f668a9bc6872ae937e6ffb74136.exe
-
Size
2.0MB
-
MD5
55e68f668a9bc6872ae937e6ffb74136
-
SHA1
b5621bc9452e41de3f170a3ab213dbbbca533a34
-
SHA256
7f99f9415b4cfa7a90a6e3f5f623112defe700ae2d33df28ddae4b4b8f0340d9
-
SHA512
73172b78a8a671217c3cc56768c8c630f3a2628e25c42287bddb531ecae8e46e9183273bef075254dab1fbfa8bdcf1f56a6fd0efd81cffb21c18bf3fd8a7cc26
-
SSDEEP
49152:7rYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:7dxVJC9UqRzsu+8N
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55e68f668a9bc6872ae937e6ffb74136.exe"C:\Users\Admin\AppData\Local\Temp\55e68f668a9bc6872ae937e6ffb74136.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
9.9MB