Analysis
-
max time kernel
104s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:33
General
-
Target
0ea0e36c7047f7b2bf48101f2d9f62467b4bbf3749386f53ed607061ad0f0ed3.exe
-
Size
2.0MB
-
MD5
6283ec3aa9c3465a0a642253cc203917
-
SHA1
d580984ae888c69292248facf6bbe4d9db838d0d
-
SHA256
0ea0e36c7047f7b2bf48101f2d9f62467b4bbf3749386f53ed607061ad0f0ed3
-
SHA512
e2f67803acec9ff1348af2bcf461a647743c887f96d5bf39e757edc956a5b2b90fd8cec5abb7bba5b0882ecfe54c7cd503cb53f5d345caf3e98eb022f458f756
-
SSDEEP
49152:brYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:bdxVJC9UqRzsu+8N
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ea0e36c7047f7b2bf48101f2d9f62467b4bbf3749386f53ed607061ad0f0ed3.exe"C:\Users\Admin\AppData\Local\Temp\0ea0e36c7047f7b2bf48101f2d9f62467b4bbf3749386f53ed607061ad0f0ed3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
2.0MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
10.8MB