Extracted

• • Target
    patch_diag.exe
  • Size 509KB
  • SHA256 c380268d493e0cba914ce2bc55faa1d7c050c599893c3196fee01fa745e6466a
  • MD5 8567983c4fde4b108b2a7168ecbf7997
  • SHA1 3824e0677dd6d925bec4c2e99f1498ce2d0ad821
  • SHA512 26e8c19b527d446ace431cd699e8fae93034b3629401504423220165eb31e72072f11346cb737d57ef268c738b1b903366a08e6abc8b02d0e47d950d90d3226f
  • SSDEEP 12288:fhoUZeviEqMeV89bROjl/1yJIRHqPuCA6H4pD0ai95WQHlTS:iUkn7eWBR5JIRR16zxvWaTS
  • TLSH
    T140B4AE2573E80E54E2FBDF78A4B171014ABABA4AD927DB9D1D0420CE0973B45EC91F72
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionevasionexecutioncrysomeratpersistencerattrojan

  • Detects CrysomeRAT Client

  • Family: CrysomeRAT

    CrysomeRAT is a Windows RAT written in C#.

    ratcrysomerat

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Disables service(s)

    defense_evasionexecution

  • Stops running service(s)

    defense_evasionexecution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2