File name:

DarkCrystalRAT_Slayed.exe

Full analysis: https://app.any.run/tasks/b7e99d81-3dc1-4aec-b088-3c94aca9fa67
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: October 05, 2024, 18:28:06
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
dcrat
remote
darkcrystal
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

7FEA7DACBF9C713142FB14AA05B6E4BD

SHA1:

1264CCD5E0F62FF698F861A6FEADDC3FCF95E74C

SHA256:

E3A3C19A4112327268F389E3D3CD51CF3135919275E8ACF3AE3114A87ACE4A5A

SSDEEP:

49152:fc/2OCvr+J5Z9QuTEBs7dNsDOUkOeM7Ds1LIQ2lyWjBLEZheqxuxSmE/Eza/P2Xf:ftr+SqBTOeM7DOLSlyWjBLEDeqxuc/Pu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • ctfmon.exe (PID: 5708)
      • ctfmon.exe (PID: 4088)
      • ctfmon.exe (PID: 5048)
      • ctfmon.exe (PID: 4644)
      • ctfmon.exe (PID: 3384)
      • ctfmon.exe (PID: 3980)
      • ctfmon.exe (PID: 4576)
      • ctfmon.exe (PID: 2824)

    • DARKCRYSTAL has been detected (SURICATA)

      • ctfmon.exe (PID: 5708)
      • ctfmon.exe (PID: 4088)
      • ctfmon.exe (PID: 4644)
      • ctfmon.exe (PID: 5048)
      • ctfmon.exe (PID: 3384)
      • ctfmon.exe (PID: 3980)
      • ctfmon.exe (PID: 2824)
      • ctfmon.exe (PID: 4576)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • DarkCrystalRAT_Slayed.exe (PID: 1236)

    • Executable content was dropped or overwritten

      • DarkCrystalRAT_Slayed.exe (PID: 1236)

    • Executing commands from a ".bat" file

      • DarkCrystalRAT_Slayed.exe (PID: 1236)
      • ctfmon.exe (PID: 5708)
      • ctfmon.exe (PID: 4088)
      • ctfmon.exe (PID: 5048)
      • ctfmon.exe (PID: 4644)
      • ctfmon.exe (PID: 3384)
      • ctfmon.exe (PID: 3980)
      • ctfmon.exe (PID: 4576)
      • ctfmon.exe (PID: 2824)

    • Starts CMD.EXE for commands execution

      • DarkCrystalRAT_Slayed.exe (PID: 1236)
      • ctfmon.exe (PID: 5708)
      • ctfmon.exe (PID: 4088)
      • ctfmon.exe (PID: 5048)
      • ctfmon.exe (PID: 4644)
      • ctfmon.exe (PID: 3384)
      • ctfmon.exe (PID: 3980)
      • ctfmon.exe (PID: 4576)
      • ctfmon.exe (PID: 2824)

    • Likely accesses (executes) a file from the Public directory

      • ctfmon.exe (PID: 5708)
      • ctfmon.exe (PID: 4088)
      • ctfmon.exe (PID: 5048)
      • ctfmon.exe (PID: 4644)
      • ctfmon.exe (PID: 3384)
      • ctfmon.exe (PID: 3980)
      • ctfmon.exe (PID: 4576)
      • ctfmon.exe (PID: 2824)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5164)
      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 1184)
      • cmd.exe (PID: 2492)
      • cmd.exe (PID: 3148)
      • cmd.exe (PID: 2008)
      • cmd.exe (PID: 5052)
      • cmd.exe (PID: 5832)
      • cmd.exe (PID: 4120)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 5164)
      • cmd.exe (PID: 1184)
      • cmd.exe (PID: 2492)
      • cmd.exe (PID: 3148)
      • cmd.exe (PID: 2008)
      • cmd.exe (PID: 5052)
      • cmd.exe (PID: 5832)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 4120)

    • Connects to the server without a host name

      • ctfmon.exe (PID: 4088)
      • ctfmon.exe (PID: 4644)
      • ctfmon.exe (PID: 3384)
      • ctfmon.exe (PID: 3980)
      • ctfmon.exe (PID: 4576)
      • ctfmon.exe (PID: 2824)
      • ctfmon.exe (PID: 5048)

  • INFO

    • Changes the display of characters in the console

      • cmd.exe (PID: 1184)
      • cmd.exe (PID: 5164)
      • cmd.exe (PID: 2492)
      • cmd.exe (PID: 3148)
      • cmd.exe (PID: 2008)
      • cmd.exe (PID: 5052)
      • cmd.exe (PID: 5832)
      • cmd.exe (PID: 4120)
      • cmd.exe (PID: 7020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (55.8)
.exe | Win64 Executable (generic) (21)
.scr | Windows screen saver (9.9)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:09:18 01:48:37+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 1940992
InitializedDataSize: 1536
UninitializedDataSize: -
EntryPoint: 0x1dbcae
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 16.10.31418.88
ProductVersionNumber: 16.10.31418.88
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: -
FileDescription: -
FileVersion: 16.10.31418.88
InternalName: VisualStudio.Shell.Framework.dll
LegalCopyright: © All rights reserved.
OriginalFileName: VisualStudio.Shell.Framework.dll
ProductName: -
ProductVersion: -
AssemblyVersion: 16.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
173
Monitored processes
45
Malicious processes
16
Suspicious processes
0

Behavior graph

Click at the process to see the details
start darkcrystalrat_slayed.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DARKCRYSTAL ctfmon.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DARKCRYSTAL ctfmon.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DARKCRYSTAL ctfmon.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DARKCRYSTAL ctfmon.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DARKCRYSTAL ctfmon.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DARKCRYSTAL ctfmon.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DARKCRYSTAL ctfmon.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DARKCRYSTAL ctfmon.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
400\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
752\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1076\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1184C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\P3GfhtSGIt.bat" "C:\Windows\System32\cmd.exe—DarkCrystalRAT_Slayed.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
1236"C:\Users\admin\Desktop\DarkCrystalRAT_Slayed.exe" C:\Users\admin\Desktop\DarkCrystalRAT_Slayed.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
16.10.31418.88
Modules
Images
c:\users\admin\desktop\darkcrystalrat_slayed.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1404\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1636w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
1928chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
Total events
11 220
Read events
11 205
Write events
15
Delete events
0

Modification events

(PID) Process:(1236) DarkCrystalRAT_Slayed.exeKey:HKEY_CURRENT_USER\SOFTWARE\b7219b5593ff7bd6847c804d596ce25864fdbbe8
Operation:writeName:3648b2a2d0c0dc37782a69486c46a830d3237e06
Value:
H4sIAAAAAAAEAH2PMQ7CMAxFr1J1RhyArZSFAalqgQUjZBIjoiZx5SSC3p6UhQHKZPvpP+n7VNYrgEMgCQConfEAjVExCWVQoyPBomVrAbba0pKeVC5+OBt+eMuoM+kIRd2rYfgTVsmRj5nsxuJoNPHkjSGS+5aadLVG5WgK01Dx5tjPxyqlOPn4eaLNl3G0Fu5J5jtR6CMPeUHpa8ld0LbV/tJZHEm/tfMLSEFBFi0BAAA=
(PID) Process:(5708) ctfmon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ctfmon_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5708) ctfmon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ctfmon_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5708) ctfmon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ctfmon_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5708) ctfmon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ctfmon_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5708) ctfmon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ctfmon_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5708) ctfmon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ctfmon_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5708) ctfmon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ctfmon_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5708) ctfmon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ctfmon_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5708) ctfmon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ctfmon_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
5
Suspicious files
0
Text files
23
Unknown types
0

Dropped files

PID
Process
Filename
Type
1236DarkCrystalRAT_Slayed.exeC:\Users\Public\Music\ctfmon.exeexecutable
MD5:7FEA7DACBF9C713142FB14AA05B6E4BD
SHA256:E3A3C19A4112327268F389E3D3CD51CF3135919275E8ACF3AE3114A87ACE4A5A
1236DarkCrystalRAT_Slayed.exeC:\Users\admin\Pictures\Camera Roll\Idle.exeexecutable
MD5:7FEA7DACBF9C713142FB14AA05B6E4BD
SHA256:E3A3C19A4112327268F389E3D3CD51CF3135919275E8ACF3AE3114A87ACE4A5A
1236DarkCrystalRAT_Slayed.exeC:\Users\admin\Pictures\Camera Roll\6ccacd8608530ftext
MD5:086926A77B06EF66DCC98C6B4B34922A
SHA256:EFD154BC0732D4CF76493A816CD453DEECC17FDCDAC3EBC54A001A40A4EDCF4A
1236DarkCrystalRAT_Slayed.exeC:\Users\admin\Videos\System.exeexecutable
MD5:7FEA7DACBF9C713142FB14AA05B6E4BD
SHA256:E3A3C19A4112327268F389E3D3CD51CF3135919275E8ACF3AE3114A87ACE4A5A
1236DarkCrystalRAT_Slayed.exeC:\Users\admin\Downloads\SearchApp.exeexecutable
MD5:7FEA7DACBF9C713142FB14AA05B6E4BD
SHA256:E3A3C19A4112327268F389E3D3CD51CF3135919275E8ACF3AE3114A87ACE4A5A
1236DarkCrystalRAT_Slayed.exeC:\Users\Public\Music\26c12092da979ctext
MD5:8A3310A465C899D0751C21EAE8582094
SHA256:4576D36296FA49652C5A850F2941F2AD0FD87884783307192D905299CD77B1D0
1236DarkCrystalRAT_Slayed.exeC:\Users\admin\Downloads\38384e6a620884text
MD5:CCAC3B5046A50D262DD06C093E0D69B7
SHA256:374E98A68AB8808FC249B1057BBA52F0C4FF6F9BAAE4BE0201276A198EC021C9
1236DarkCrystalRAT_Slayed.exeC:\Users\Public\AccountPictures\9e8d7a4ca61bd9text
MD5:D640245C352FB5F2032E1CD36D1468B0
SHA256:B9C936DBA3F19264BCA910C6B937FB5B26F423CFCDFD3EB1BD5ED54E87A13C9A
1236DarkCrystalRAT_Slayed.exeC:\Users\Public\AccountPictures\RuntimeBroker.exeexecutable
MD5:7FEA7DACBF9C713142FB14AA05B6E4BD
SHA256:E3A3C19A4112327268F389E3D3CD51CF3135919275E8ACF3AE3114A87ACE4A5A
1236DarkCrystalRAT_Slayed.exeC:\Users\admin\Videos\27d1bcfc3c54e0text
MD5:036C1DA9903347DEFDE09446A9EA46C8
SHA256:1FAF6A7D979AEF90BC2277403C93F2FE12B64632B09F7B1E667C7C2879EB851F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
51
DNS requests
15
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
68
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5708
ctfmon.exe
POST
200
194.110.248.41:80
http://194.110.248.41/6JsUpdateuniversal/defaultbase/95base4/Central8Low/Processjs/default/privateGeouploads/Wpgamewp/Voiddb7/FlowerUpdateauth8/ProcessDle/Update/privatemariadbJavascriptprotect/downloads9/voiddb/Multiserver3/BetterAuthDump/Api5game/ImagevmpythonJavascript_linuxFlowerUniversalTemp.php
unknown
—
—
malicious
4088
ctfmon.exe
POST
200
194.110.248.41:80
http://194.110.248.41/6JsUpdateuniversal/defaultbase/95base4/Central8Low/Processjs/default/privateGeouploads/Wpgamewp/Voiddb7/FlowerUpdateauth8/ProcessDle/Update/privatemariadbJavascriptprotect/downloads9/voiddb/Multiserver3/BetterAuthDump/Api5game/ImagevmpythonJavascript_linuxFlowerUniversalTemp.php
unknown
—
—
malicious
5048
ctfmon.exe
POST
200
194.110.248.41:80
http://194.110.248.41/6JsUpdateuniversal/defaultbase/95base4/Central8Low/Processjs/default/privateGeouploads/Wpgamewp/Voiddb7/FlowerUpdateauth8/ProcessDle/Update/privatemariadbJavascriptprotect/downloads9/voiddb/Multiserver3/BetterAuthDump/Api5game/ImagevmpythonJavascript_linuxFlowerUniversalTemp.php
unknown
—
—
malicious
6988
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4644
ctfmon.exe
POST
200
194.110.248.41:80
http://194.110.248.41/6JsUpdateuniversal/defaultbase/95base4/Central8Low/Processjs/default/privateGeouploads/Wpgamewp/Voiddb7/FlowerUpdateauth8/ProcessDle/Update/privatemariadbJavascriptprotect/downloads9/voiddb/Multiserver3/BetterAuthDump/Api5game/ImagevmpythonJavascript_linuxFlowerUniversalTemp.php
unknown
—
—
malicious
6988
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5740
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3384
ctfmon.exe
POST
200
194.110.248.41:80
http://194.110.248.41/6JsUpdateuniversal/defaultbase/95base4/Central8Low/Processjs/default/privateGeouploads/Wpgamewp/Voiddb7/FlowerUpdateauth8/ProcessDle/Update/privatemariadbJavascriptprotect/downloads9/voiddb/Multiserver3/BetterAuthDump/Api5game/ImagevmpythonJavascript_linuxFlowerUniversalTemp.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4288
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4324
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5708
ctfmon.exe
194.110.248.41:80
—
Oleksandr Siedinkin
UA
malicious
68
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
68
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.110
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.133
  • 40.126.32.136
  • 40.126.32.134
  • 40.126.32.72
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
5708
ctfmon.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
5708
ctfmon.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
4088
ctfmon.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
4088
ctfmon.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
5048
ctfmon.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
5048
ctfmon.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
4644
ctfmon.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
4644
ctfmon.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
3384
ctfmon.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
3384
ctfmon.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DarkCrystalRAT_Slayed.exe