Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/03/2025, 06:13
General
-
Target
76d2a80297031a02e7591d8ab858a2d7.exe
-
Size
2.0MB
-
MD5
76d2a80297031a02e7591d8ab858a2d7
-
SHA1
ec00834dc57378e344872434f95a37837241fca0
-
SHA256
2ce5203e37ddc015f27ec1a3e1fe8b332e383cbaf5ae7e22aaed9b23c609ea6f
-
SHA512
0a2f318e49ec8e8c32dbc1f028445bc712fc7d06d2eb915c55d80cc5a360a61c045e7778a3c9110c2ab92236cb5870754c1ed9fce5f11f2cc3833edcbb5d2ea7
-
SSDEEP
49152:8DM6kxEuF98kPO2wjovVRbloub6AKcILOw5MNu/I:8Nba98kPZwSJayUOwku/I
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\76d2a80297031a02e7591d8ab858a2d7.exe"C:\Users\Admin\AppData\Local\Temp\76d2a80297031a02e7591d8ab858a2d7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
9.9MB