Analysis
- max time kernel
148s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
27/05/2024, 17:28
General
- Target DCRat.exe
- Size 72KB
- Sample240527-v2fllacf56
- SHA256 5ede5d774ab65f25357cf5a1fa5e354f6f2a9868651a0fa717485802b21b1939
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DCRat.exe"C:\Users\Admin\AppData\Local\Temp\DCRat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dprism.dirtyopts=false -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllI.jar;lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllIIilIl.jar;lib\IIlIlIllIIlIIllIIllIIlIIIllIlIlIlIIIIlIlIllIIlIIllIIIIIllIIIIlIIIlIIlIIlIIlIllIIlllIIIllIIIlIIlIllllIllIIIIlIIIlIllllllI.jar;lib\IlIIlIllllIIIIIlIlllIllIlIlIIIIIlIIIlIlIlllIIllIllIIIIIIlIIlllIIIlIIIlllIIIlllllIlIlIlllllIIlIllIIlIIlIIlIIIlllllllIlIII.jar;lib\IlIlIIIIIIIlIlllllllIllIIlIIllIllllIIIlIIIlIlIIlIIlIIlIllIlllIlIlIIllIIlIIIIIIIlIIIIIIIIIlIlllIIllIlIIlIIIlIlIlllIIIIIIl.jar;lib\IlIllIIllllllllIlIIlllllIIIIllIIIlIIlllIIllIIllllIIllIlIIIlIIIIlIIIIIlllllllIllIIlIlIllIIlIlIlIIllIlIllIIIlIIIIlIllIIIIl.jar;lib\IllIIIIllIlIIIIlIlIllIIlIIllIIlIllIIlllllIlllIllIlIIlIIlllIIlIlIlIllIllIIlIIIlIIIllIIIIIllIIlllllIlIIIIIlIIIIIIIIIIIIlII.jar;lib\lIIllIIlIlllIlIlllIlIIlIIIlllllIIlIlIIllIllIlIlllIlIIlIlIlIIllIlIIIIIllIIlIIlIIlIIllIIIlIIllIlIIIIlIlIIlIIlIllIIlIIlIlIl.jar;lib\llIlIIIIlIlIlllllIlIIllllIIIlIlIllllIIllllIlllIIlllllIIlIlllIIIIIIlIIllIIIlIlIlllIlIIIlIIIIIllIlllIlllIIllIIllIlIlIIlllI.jar;lib\llIlIlIIIllllIIIllllllllllIllIlIlllIIlllIIlllIIllIIllllIlllIIIIIllllIIlllIIllIIIIlIlIlIlIIIlIIIlIlIlIlIIlllIIlllIlIlIlII.jar;lib\lllIIlIlIIlIIllllIIllllIIlIllllIIIlIllllIIllIIIlllIIIIIIlIIlllIIllIllIIlllIlIIlIlIlllIIlllIlllIlIIlIIIllIlllIIIlIIIIIlll.jar;lib\lllIlIIIIIlIllIlIlIIllIlIIIlIIllIllllIIIIIllIlllIllIIllIIllIllIllIIlIlllllIIlIllIllIIlIIlIIIllIlIlIIlIIIIIIIllIIlllIllIl.jar;lib\llllIlIIIIIllllIlIIIlIllIlIIIllllIIIllIllllIIlllIlIIIlllIIlIlIlllIIlIIIIlIIIIlllIIlIIlIlIIIIIIIIllllIllIlIIIlIllIlIlIIll.jar;lib\llllIlIIlIllllIlIlIIIlIIIlIllIlIIIIlIlIIlIlIIIIllIIlIIllIIIllllIlIllIlllllIIIIIIIIllIllIlIlllllllIllIIIllllIIllIIlIllIll.jar" org.develnext.jphp.ext.javafx.FXLauncher2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboard get Manufac ��3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe baseboard get Manufac4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c USERPR ��3⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboap��3� ��3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe baseboap��3� ��4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe CPU get Proc ��8�Y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe CPU get Proc4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Index*'L��] ��\�X[�[X�\\"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe diskdrive where "'Index*'L��] ��\�X[�[X�\\"4⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[� ���\�3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[� ���\�4⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L����] ��^"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L����] ��^"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/2172-0-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4008-3-0x0000026D86DE0000-0x0000026D87050000-memory.dmp
memory/4008-13-0x0000026D86DC0000-0x0000026D86DC1000-memory.dmp
memory/4008-17-0x0000026D87050000-0x0000026D87060000-memory.dmp
memory/4008-18-0x0000026D87060000-0x0000026D87070000-memory.dmp
memory/4008-21-0x0000026D87070000-0x0000026D87080000-memory.dmp
memory/4008-22-0x0000026D87080000-0x0000026D87090000-memory.dmp
memory/4008-25-0x0000026D87090000-0x0000026D870A0000-memory.dmp
memory/4008-26-0x0000026D870A0000-0x0000026D870B0000-memory.dmp
memory/4008-28-0x0000026D86DC0000-0x0000026D86DC1000-memory.dmp
memory/4008-29-0x0000026D870B0000-0x0000026D870C0000-memory.dmp
memory/4008-32-0x0000026D870C0000-0x0000026D870D0000-memory.dmp
memory/4008-38-0x0000026D86DE0000-0x0000026D87050000-memory.dmp
memory/4008-40-0x0000026D870E0000-0x0000026D870F0000-memory.dmp
memory/4008-39-0x0000026D870D0000-0x0000026D870E0000-memory.dmp
memory/4008-42-0x0000026D870F0000-0x0000026D87100000-memory.dmp
memory/4008-45-0x0000026D87100000-0x0000026D87110000-memory.dmp
memory/4008-44-0x0000026D87050000-0x0000026D87060000-memory.dmp
memory/4008-48-0x0000026D87110000-0x0000026D87120000-memory.dmp
memory/4008-47-0x0000026D87060000-0x0000026D87070000-memory.dmp
memory/4008-52-0x0000026D87120000-0x0000026D87130000-memory.dmp
memory/4008-51-0x0000026D87070000-0x0000026D87080000-memory.dmp
memory/4008-55-0x0000026D87130000-0x0000026D87140000-memory.dmp
memory/4008-54-0x0000026D87080000-0x0000026D87090000-memory.dmp
memory/4008-61-0x0000026D87150000-0x0000026D87160000-memory.dmp
memory/4008-60-0x0000026D87140000-0x0000026D87150000-memory.dmp
memory/4008-59-0x0000026D87090000-0x0000026D870A0000-memory.dmp
memory/4008-63-0x0000026D870A0000-0x0000026D870B0000-memory.dmp
memory/4008-64-0x0000026D87160000-0x0000026D87170000-memory.dmp
memory/4008-69-0x0000026D87170000-0x0000026D87180000-memory.dmp
memory/4008-71-0x0000026D87190000-0x0000026D871A0000-memory.dmp
memory/4008-70-0x0000026D87180000-0x0000026D87190000-memory.dmp
memory/4008-68-0x0000026D870B0000-0x0000026D870C0000-memory.dmp
memory/4008-74-0x0000026D871A0000-0x0000026D871B0000-memory.dmp
memory/4008-78-0x0000026D870D0000-0x0000026D870E0000-memory.dmp
memory/4008-82-0x0000026D871D0000-0x0000026D871E0000-memory.dmp
memory/4008-81-0x0000026D871C0000-0x0000026D871D0000-memory.dmp
memory/4008-80-0x0000026D871B0000-0x0000026D871C0000-memory.dmp
memory/4008-79-0x0000026D870E0000-0x0000026D870F0000-memory.dmp
memory/4008-73-0x0000026D870C0000-0x0000026D870D0000-memory.dmp
memory/4008-84-0x0000026D870F0000-0x0000026D87100000-memory.dmp
memory/4008-85-0x0000026D871E0000-0x0000026D871F0000-memory.dmp
memory/4008-88-0x0000026D871F0000-0x0000026D87200000-memory.dmp
memory/4008-87-0x0000026D87100000-0x0000026D87110000-memory.dmp
memory/4008-93-0x0000026D87110000-0x0000026D87120000-memory.dmp
memory/4008-94-0x0000026D87200000-0x0000026D87210000-memory.dmp
memory/4008-99-0x0000026D87120000-0x0000026D87130000-memory.dmp
memory/4008-100-0x0000026D87210000-0x0000026D87220000-memory.dmp
memory/4008-102-0x0000026D87130000-0x0000026D87140000-memory.dmp
memory/4008-103-0x0000026D87220000-0x0000026D87230000-memory.dmp
memory/4008-107-0x0000026D87150000-0x0000026D87160000-memory.dmp
memory/4008-108-0x0000026D87230000-0x0000026D87240000-memory.dmp
memory/4008-111-0x0000026D87240000-0x0000026D87250000-memory.dmp
memory/4008-110-0x0000026D87160000-0x0000026D87170000-memory.dmp
memory/4008-106-0x0000026D87140000-0x0000026D87150000-memory.dmp
memory/4008-112-0x0000026D86DC0000-0x0000026D86DC1000-memory.dmp
memory/4008-114-0x0000026D87170000-0x0000026D87180000-memory.dmp
memory/4008-117-0x0000026D87250000-0x0000026D87260000-memory.dmp
memory/4008-116-0x0000026D87190000-0x0000026D871A0000-memory.dmp
memory/4008-115-0x0000026D87180000-0x0000026D87190000-memory.dmp
memory/4008-121-0x0000026D87260000-0x0000026D87270000-memory.dmp
memory/4008-120-0x0000026D871A0000-0x0000026D871B0000-memory.dmp
memory/4008-126-0x0000026D87270000-0x0000026D87280000-memory.dmp
memory/4008-125-0x0000026D871D0000-0x0000026D871E0000-memory.dmp
memory/4008-124-0x0000026D871C0000-0x0000026D871D0000-memory.dmp
memory/4008-123-0x0000026D871B0000-0x0000026D871C0000-memory.dmp
memory/4008-128-0x0000026D871E0000-0x0000026D871F0000-memory.dmp
memory/4008-129-0x0000026D87280000-0x0000026D87290000-memory.dmp
memory/4008-135-0x0000026D87290000-0x0000026D872A0000-memory.dmp
memory/4008-131-0x0000026D871F0000-0x0000026D87200000-memory.dmp
memory/4008-138-0x0000026D872A0000-0x0000026D872B0000-memory.dmp
memory/4008-142-0x0000026D872D0000-0x0000026D872E0000-memory.dmp
memory/4008-141-0x0000026D872C0000-0x0000026D872D0000-memory.dmp
memory/4008-140-0x0000026D87210000-0x0000026D87220000-memory.dmp
memory/4008-137-0x0000026D87200000-0x0000026D87210000-memory.dmp
memory/4008-136-0x0000026D872B0000-0x0000026D872C0000-memory.dmp
memory/4008-147-0x0000026D86DC0000-0x0000026D86DC1000-memory.dmp
memory/4008-158-0x0000026D86DC0000-0x0000026D86DC1000-memory.dmp
memory/4008-160-0x0000026D86DC0000-0x0000026D86DC1000-memory.dmp
memory/4008-238-0x0000026D86DC0000-0x0000026D86DC1000-memory.dmp
memory/4008-239-0x0000026D87220000-0x0000026D87230000-memory.dmp
memory/4008-248-0x0000026D86DC0000-0x0000026D86DC1000-memory.dmp
memory/4008-337-0x0000026D86DC0000-0x0000026D86DC1000-memory.dmp
memory/4008-602-0x0000026D87230000-0x0000026D87240000-memory.dmp
memory/4008-658-0x0000026D87240000-0x0000026D87250000-memory.dmp
memory/4008-662-0x0000026D87250000-0x0000026D87260000-memory.dmp
memory/4008-665-0x0000026D87260000-0x0000026D87270000-memory.dmp
memory/4008-669-0x0000026D87270000-0x0000026D87280000-memory.dmp
memory/4008-672-0x0000026D87280000-0x0000026D87290000-memory.dmp
memory/4008-673-0x0000026D87290000-0x0000026D872A0000-memory.dmp
memory/4008-676-0x0000026D872B0000-0x0000026D872C0000-memory.dmp
memory/4008-679-0x0000026D872A0000-0x0000026D872B0000-memory.dmp
memory/4008-682-0x0000026D872D0000-0x0000026D872E0000-memory.dmp
memory/4008-681-0x0000026D872C0000-0x0000026D872D0000-memory.dmp