Analysis

  • max time kernel
    104s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:13

General

  • Target

    7ca42dc286ca99ecb75ab26cc68042f04556b199feb0ecdece718faf13b8de36.exe

  • Size

    2.0MB

  • MD5

    f21def2cacce9d2149abd673f344fbc0

  • SHA1

    ea64f2a295933c32fd01ce7ac91cf5e9cdaeb491

  • SHA256

    7ca42dc286ca99ecb75ab26cc68042f04556b199feb0ecdece718faf13b8de36

  • SHA512

    8d731bd745723001bed0796ea31751a90bc926a562e7ac6d315623c376e1ce6da03d648d35147571c3905180c9927f3d23ef3e017a3d4907e6e22b60103837a9

  • SSDEEP

    49152:7rYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:7dxVJC9UqRzsu+8N

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ca42dc286ca99ecb75ab26cc68042f04556b199feb0ecdece718faf13b8de36.exe
    "C:\Users\Admin\AppData\Local\Temp\7ca42dc286ca99ecb75ab26cc68042f04556b199feb0ecdece718faf13b8de36.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2708-0-0x00007FF8D52D3000-0x00007FF8D52D5000-memory.dmp

    Filesize

    8KB

  • memory/2708-1-0x0000000000920000-0x0000000000B2A000-memory.dmp

    Filesize

    2.0MB

  • memory/2708-2-0x00007FF8D52D0000-0x00007FF8D5D91000-memory.dmp

    Filesize

    10.8MB

  • memory/2708-3-0x0000000001430000-0x000000000143E000-memory.dmp

    Filesize

    56KB

  • memory/2708-4-0x0000000002C30000-0x0000000002C3E000-memory.dmp

    Filesize

    56KB

  • memory/2708-6-0x00007FF8D52D0000-0x00007FF8D5D91000-memory.dmp

    Filesize

    10.8MB