crysomerat | f30f32937999abe4fa6e90234773e0528a4b2bd1d6de5323d59ac96cdb58f25d

Resubmissions

09/05/2026, 03:44

09/05/2026, 03:43

09/05/2026, 03:37

user interaction
yes
max time kernel
12s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 03:43

Target
ultimate supreme cry.exe
Size 508KB
Sample260509-eaachaat61
SHA256 f30f32937999abe4fa6e90234773e0528a4b2bd1d6de5323d59ac96cdb58f25d
MD5 03898be29fb6c5464b28ae0239713b7b
SHA1 a89158fe7d762dca8f136498a4120e3597933cab
SHA512 f0c8287ff29acb8b3b05ba2a28dc1907ed4145777003a9a905cc30bbc803515004e4e1facc2563c0cbf449b851e7a64adf6af0a04ad848d4094588d660e8dad1
SSDEEP 12288:zhoUZeviEqMeV89bROjl/1yJIRHqPuCA6H4pD0ai95WQHlT:GUkn7eWBR5JIRR16zxvWaT
TLSH
T151B4AE2573E80E55E2FBDF78A4B172014ABABA4A9927DB4D1D0410CE0D73B85EC51FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

crysomerat rat

Family: CrysomeRAT
CrysomeRAT is a Windows RAT written in C#.
rat crysomerat

Detects CrysomeRAT Client 2 IoCs

resource	yara_rule
behavioral1/memory/2776-0-0x000001FF2A8B0000-0x000001FF2A936000-memory.dmp	family_crysome_client
behavioral1/files/0x001c00000002b248-12.dat	family_crysome_client

Executes dropped EXE 1 IoCs

pid	Process
3392	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2776	ultimate supreme cry.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	ultimate supreme cry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 3392	2776	ultimate supreme cry.exe	80

C:\Users\Admin\AppData\Local\Temp\ultimate supreme cry.exe
"C:\Users\Admin\AppData\Local\Temp\ultimate supreme cry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  PID:3392

Crysome_debug.log

Path C:\Users\Admin\AppData\Local\Temp\Crysome_debug.log
Size 375B
SHA256 b738c9cd81a26ff5f1d25a716f1f5f0e1c7ae168f8bee58fc9b3a02903311d3a
MD5 b9eb831e64916b4d38913322b53344da
SHA1 27b8eafca0fd82283078292de9513948ad826b1d
SHA512 43aed9b165f82c4ae5b4d248b52317bf134171caf2b4023bdda0954a04becab4d023ec928d2a40d62a88ca8a7842f31b4fb969735e8091a4466dca9b8d2a9e11
TLSH
T150E0925C23CBA1DA44CD0D91C4F32C91FDED6E792A65EDB1D5F3320C10C45989131E21
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe
Size 508KB
SHA256 f30f32937999abe4fa6e90234773e0528a4b2bd1d6de5323d59ac96cdb58f25d
MD5 03898be29fb6c5464b28ae0239713b7b
SHA1 a89158fe7d762dca8f136498a4120e3597933cab
SHA512 f0c8287ff29acb8b3b05ba2a28dc1907ed4145777003a9a905cc30bbc803515004e4e1facc2563c0cbf449b851e7a64adf6af0a04ad848d4094588d660e8dad1
SSDEEP 12288:zhoUZeviEqMeV89bROjl/1yJIRHqPuCA6H4pD0ai95WQHlT:GUkn7eWBR5JIRR16zxvWaT
TLSH
T151B4AE2573E80E55E2FBDF78A4B172014ABABA4A9927DB4D1D0410CE0D73B85EC51FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2776-0-0x000001FF2A8B0000-0x000001FF2A936000-memory.dmp

Download