Analysis
-
max time kernel
103s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:14
General
-
Target
915c452bf258459048ef8813fe2586a7b3c85ae7438fcd9bfa6da3a4017a08b6.exe
-
Size
2.0MB
-
MD5
36d39f96697aecd3fc5a465d4db663b8
-
SHA1
2a2201725368c253784a4d05f6e676ac5c10aa9e
-
SHA256
915c452bf258459048ef8813fe2586a7b3c85ae7438fcd9bfa6da3a4017a08b6
-
SHA512
75b6de4d9d2461821f2e313572f28163254ce9eb6456d5c4cac91efc7ca96ba60087bbcd69dfe8ba382f4c2fd3d25a567309a4881890e781bd9867dc6006b309
-
SSDEEP
49152:jrYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:jdxVJC9UqRzsu+8N
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\915c452bf258459048ef8813fe2586a7b3c85ae7438fcd9bfa6da3a4017a08b6.exe"C:\Users\Admin\AppData\Local\Temp\915c452bf258459048ef8813fe2586a7b3c85ae7438fcd9bfa6da3a4017a08b6.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
2.0MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
10.8MB