dcrat | f03374f670758c1ae4b23bb320aab096a8929f4a822a37b6908c7eebc1497fb8

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 01:23

Target

f03374f670758c1ae4b23bb320aab096a8929f4a822a37b6908c7eebc1497fb8.exe
Size

1.2MB
MD5

5973141a1645142524005a976300ad3a
SHA1

ead922ce88867e6804ff1d47f1e030a093675da4
SHA256

f03374f670758c1ae4b23bb320aab096a8929f4a822a37b6908c7eebc1497fb8
SHA512

00d1c6cd2b593a13cb0b823da7962481248916858951424b33e0224a2a1ad03df9e482e2da83db0af6451c7024701b4c74643b9ed8f549ea24800e5f7b6612aa
SSDEEP

24576:GKR+wELNASn7ahkX4j9wjlP17rQFGWEdcM4:Gvw+GyX5517IGW

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
rat

Processes:

resource yara_rule

behavioral1/memory/1636-1-0x0000000000860000-0x0000000000994000-memory.dmp dcrat
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f03374f670758c1ae4b23bb320aab096a8929f4a822a37b6908c7eebc1497fb8.exe

description pid process

Token: SeDebugPrivilege 1636 f03374f670758c1ae4b23bb320aab096a8929f4a822a37b6908c7eebc1497fb8.exe

resource	yara_rule
behavioral1/memory/1636-1-0x0000000000860000-0x0000000000994000-memory.dmp	dcrat

description	pid	process
Token: SeDebugPrivilege	1636	f03374f670758c1ae4b23bb320aab096a8929f4a822a37b6908c7eebc1497fb8.exe

C:\Users\Admin\AppData\Local\Temp\f03374f670758c1ae4b23bb320aab096a8929f4a822a37b6908c7eebc1497fb8.exe
"C:\Users\Admin\AppData\Local\Temp\f03374f670758c1ae4b23bb320aab096a8929f4a822a37b6908c7eebc1497fb8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1636

memory/1636-0-0x000007FEF5563000-0x000007FEF5564000-memory.dmp

Filesize
4KB

Download
memory/1636-1-0x0000000000860000-0x0000000000994000-memory.dmp

Filesize
1.2MB

Download
memory/1636-2-0x000007FEF5560000-0x000007FEF5F4C000-memory.dmp

Filesize
9.9MB

Download
memory/1636-3-0x00000000002C0000-0x00000000002DC000-memory.dmp

Filesize
112KB

Download
memory/1636-6-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/1636-5-0x0000000000590000-0x00000000005A6000-memory.dmp

Filesize
88KB

Download
memory/1636-4-0x00000000002E0000-0x00000000002E8000-memory.dmp

Filesize
32KB

Download
memory/1636-7-0x000007FEF5563000-0x000007FEF5564000-memory.dmp

Filesize
4KB

Download
memory/1636-8-0x000007FEF5560000-0x000007FEF5F4C000-memory.dmp

Filesize
9.9MB

Download
memory/1636-9-0x000007FEF5560000-0x000007FEF5F4C000-memory.dmp

Filesize
9.9MB

Download