Analysis
- max time kernel
124s - max time network
135s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
07/06/2024, 18:36
General
- Target v2dc/DCRat.exe
- Size 72KB
- Sample240607-w9d86sda34
- SHA256 5ede5d774ab65f25357cf5a1fa5e354f6f2a9868651a0fa717485802b21b1939
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\v2dc\DCRat.exe"C:\Users\Admin\AppData\Local\Temp\v2dc\DCRat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dprism.dirtyopts=false -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllI.jar;lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllIIilIl.jar;lib\IIlIlIllIIlIIllIIllIIlIIIllIlIlIlIIIIlIlIllIIlIIllIIIIIllIIIIlIIIlIIlIIlIIlIllIIlllIIIllIIIlIIlIllllIllIIIIlIIIlIllllllI.jar;lib\IlIIlIllllIIIIIlIlllIllIlIlIIIIIlIIIlIlIlllIIllIllIIIIIIlIIlllIIIlIIIlllIIIlllllIlIlIlllllIIlIllIIlIIlIIlIIIlllllllIlIII.jar;lib\IlIlIIIIIIIlIlllllllIllIIlIIllIllllIIIlIIIlIlIIlIIlIIlIllIlllIlIlIIllIIlIIIIIIIlIIIIIIIIIlIlllIIllIlIIlIIIlIlIlllIIIIIIl.jar;lib\IlIllIIllllllllIlIIlllllIIIIllIIIlIIlllIIllIIllllIIllIlIIIlIIIIlIIIIIlllllllIllIIlIlIllIIlIlIlIIllIlIllIIIlIIIIlIllIIIIl.jar;lib\IllIIIIllIlIIIIlIlIllIIlIIllIIlIllIIlllllIlllIllIlIIlIIlllIIlIlIlIllIllIIlIIIlIIIllIIIIIllIIlllllIlIIIIIlIIIIIIIIIIIIlII.jar;lib\lIIllIIlIlllIlIlllIlIIlIIIlllllIIlIlIIllIllIlIlllIlIIlIlIlIIllIlIIIIIllIIlIIlIIlIIllIIIlIIllIlIIIIlIlIIlIIlIllIIlIIlIlIl.jar;lib\llIlIIIIlIlIlllllIlIIllllIIIlIlIllllIIllllIlllIIlllllIIlIlllIIIIIIlIIllIIIlIlIlllIlIIIlIIIIIllIlllIlllIIllIIllIlIlIIlllI.jar;lib\llIlIlIIIllllIIIllllllllllIllIlIlllIIlllIIlllIIllIIllllIlllIIIIIllllIIlllIIllIIIIlIlIlIlIIIlIIIlIlIlIlIIlllIIlllIlIlIlII.jar;lib\lllIIlIlIIlIIllllIIllllIIlIllllIIIlIllllIIllIIIlllIIIIIIlIIlllIIllIllIIlllIlIIlIlIlllIIlllIlllIlIIlIIIllIlllIIIlIIIIIlll.jar;lib\lllIlIIIIIlIllIlIlIIllIlIIIlIIllIllllIIIIIllIlllIllIIllIIllIllIllIIlIlllllIIlIllIllIIlIIlIIIllIlIlIIlIIIIIIIllIIlllIllIl.jar;lib\llllIlIIIIIllllIlIIIlIllIlIIIllllIIIllIllllIIlllIlIIIlllIIlIlIlllIIlIIIIlIIIIlllIIlIIlIlIIIIIIIIllllIllIlIIIlIllIlIlIIll.jar;lib\llllIlIIlIllllIlIlIIIlIIIlIllIlIIIIlIlIIlIlIIIIllIIlIIllIIIllllIlIllIlllllIIIIIIIIllIllIlIlllllllIllIIIllllIIllIIlIllIll.jar" org.develnext.jphp.ext.javafx.FXLauncher2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboard get Manufac ��3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe baseboard get Manufac4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c USERPR ��3⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboap��3� ��3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe baseboap��3� ��4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe CPU get Proc ��8�Y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe CPU get Proc4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Index*'L��] ��\�X[�[X�\\"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe diskdrive where "'Index*'L��] ��\�X[�[X�\\"4⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[� ���\�3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[� ���\�4⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L����] ��^"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L����] ��^"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/996-3-0x000001EB58A10000-0x000001EB58C80000-memory.dmp
memory/996-13-0x000001EB57160000-0x000001EB57161000-memory.dmp
memory/996-14-0x000001EB57160000-0x000001EB57161000-memory.dmp
memory/996-17-0x000001EB58C80000-0x000001EB58C90000-memory.dmp
memory/996-21-0x000001EB58CA0000-0x000001EB58CB0000-memory.dmp
memory/996-20-0x000001EB58C90000-0x000001EB58CA0000-memory.dmp
memory/996-23-0x000001EB58CB0000-0x000001EB58CC0000-memory.dmp
memory/996-25-0x000001EB58CC0000-0x000001EB58CD0000-memory.dmp
memory/996-28-0x000001EB58CD0000-0x000001EB58CE0000-memory.dmp
memory/996-31-0x000001EB58CE0000-0x000001EB58CF0000-memory.dmp
memory/996-35-0x000001EB58CF0000-0x000001EB58D00000-memory.dmp
memory/996-34-0x000001EB58A10000-0x000001EB58C80000-memory.dmp
memory/996-41-0x000001EB58D00000-0x000001EB58D10000-memory.dmp
memory/996-43-0x000001EB58D10000-0x000001EB58D20000-memory.dmp
memory/996-45-0x000001EB58C80000-0x000001EB58C90000-memory.dmp
memory/996-46-0x000001EB58D20000-0x000001EB58D30000-memory.dmp
memory/996-48-0x000001EB58C90000-0x000001EB58CA0000-memory.dmp
memory/996-49-0x000001EB58D30000-0x000001EB58D40000-memory.dmp
memory/996-52-0x000001EB58D40000-0x000001EB58D50000-memory.dmp
memory/996-51-0x000001EB58CA0000-0x000001EB58CB0000-memory.dmp
memory/996-55-0x000001EB58D50000-0x000001EB58D60000-memory.dmp
memory/996-54-0x000001EB58CB0000-0x000001EB58CC0000-memory.dmp
memory/996-57-0x000001EB58CC0000-0x000001EB58CD0000-memory.dmp
memory/996-62-0x000001EB58D70000-0x000001EB58D80000-memory.dmp
memory/996-61-0x000001EB58CD0000-0x000001EB58CE0000-memory.dmp
memory/996-60-0x000001EB58D60000-0x000001EB58D70000-memory.dmp
memory/996-64-0x000001EB58CE0000-0x000001EB58CF0000-memory.dmp
memory/996-65-0x000001EB58D80000-0x000001EB58D90000-memory.dmp
memory/996-68-0x000001EB58D90000-0x000001EB58DA0000-memory.dmp
memory/996-67-0x000001EB58CF0000-0x000001EB58D00000-memory.dmp
memory/996-71-0x000001EB58D00000-0x000001EB58D10000-memory.dmp
memory/996-72-0x000001EB58DA0000-0x000001EB58DB0000-memory.dmp
memory/996-73-0x000001EB58D10000-0x000001EB58D20000-memory.dmp
memory/996-74-0x000001EB58DB0000-0x000001EB58DC0000-memory.dmp
memory/996-77-0x000001EB58DC0000-0x000001EB58DD0000-memory.dmp
memory/996-76-0x000001EB58D20000-0x000001EB58D30000-memory.dmp
memory/996-81-0x000001EB58D30000-0x000001EB58D40000-memory.dmp
memory/996-83-0x000001EB58DE0000-0x000001EB58DF0000-memory.dmp
memory/996-82-0x000001EB58DD0000-0x000001EB58DE0000-memory.dmp
memory/996-86-0x000001EB58DF0000-0x000001EB58E00000-memory.dmp
memory/996-85-0x000001EB58D40000-0x000001EB58D50000-memory.dmp
memory/996-87-0x000001EB58D50000-0x000001EB58D60000-memory.dmp
memory/996-89-0x000001EB58E00000-0x000001EB58E10000-memory.dmp
memory/996-88-0x000001EB58D60000-0x000001EB58D70000-memory.dmp
memory/996-91-0x000001EB58E10000-0x000001EB58E20000-memory.dmp
memory/996-95-0x000001EB57160000-0x000001EB57161000-memory.dmp
memory/996-100-0x000001EB58E20000-0x000001EB58E30000-memory.dmp
memory/996-99-0x000001EB58D70000-0x000001EB58D80000-memory.dmp
memory/996-102-0x000001EB57160000-0x000001EB57161000-memory.dmp
memory/996-103-0x000001EB57160000-0x000001EB57161000-memory.dmp
memory/996-115-0x000001EB58E30000-0x000001EB58E40000-memory.dmp
memory/996-114-0x000001EB58D80000-0x000001EB58D90000-memory.dmp
memory/996-111-0x000001EB57160000-0x000001EB57161000-memory.dmp
memory/996-110-0x000001EB57160000-0x000001EB57161000-memory.dmp
memory/996-120-0x000001EB58E40000-0x000001EB58E50000-memory.dmp
memory/996-119-0x000001EB58D90000-0x000001EB58DA0000-memory.dmp
memory/996-137-0x000001EB57160000-0x000001EB57161000-memory.dmp
memory/996-160-0x000001EB58E50000-0x000001EB58E60000-memory.dmp
memory/996-159-0x000001EB58DA0000-0x000001EB58DB0000-memory.dmp
memory/996-135-0x000001EB57160000-0x000001EB57161000-memory.dmp
memory/996-162-0x000001EB58E60000-0x000001EB58E70000-memory.dmp
memory/996-161-0x000001EB58DB0000-0x000001EB58DC0000-memory.dmp
memory/996-191-0x000001EB58DC0000-0x000001EB58DD0000-memory.dmp
memory/996-196-0x000001EB58DD0000-0x000001EB58DE0000-memory.dmp
memory/996-197-0x000001EB58DE0000-0x000001EB58DF0000-memory.dmp
memory/996-233-0x000001EB58DF0000-0x000001EB58E00000-memory.dmp
memory/996-290-0x000001EB58E00000-0x000001EB58E10000-memory.dmp
memory/996-321-0x000001EB58E10000-0x000001EB58E20000-memory.dmp
memory/996-382-0x000001EB58E20000-0x000001EB58E30000-memory.dmp
memory/996-688-0x000001EB58E30000-0x000001EB58E40000-memory.dmp
memory/996-725-0x000001EB58E40000-0x000001EB58E50000-memory.dmp
memory/996-738-0x000001EB58E50000-0x000001EB58E60000-memory.dmp
memory/996-747-0x000001EB58E60000-0x000001EB58E70000-memory.dmp
memory/996-810-0x000001EB58C80000-0x000001EB58C90000-memory.dmp
memory/996-812-0x000001EB58A10000-0x000001EB58C80000-memory.dmp
memory/996-816-0x000001EB58CE0000-0x000001EB58CF0000-memory.dmp
memory/996-815-0x000001EB58CD0000-0x000001EB58CE0000-memory.dmp
memory/996-814-0x000001EB58CC0000-0x000001EB58CD0000-memory.dmp
memory/996-813-0x000001EB58CB0000-0x000001EB58CC0000-memory.dmp
memory/996-811-0x000001EB58C90000-0x000001EB58CA0000-memory.dmp
memory/996-809-0x000001EB58CA0000-0x000001EB58CB0000-memory.dmp
memory/996-840-0x000001EB58E60000-0x000001EB58E70000-memory.dmp
memory/996-839-0x000001EB58E50000-0x000001EB58E60000-memory.dmp
memory/996-838-0x000001EB58E40000-0x000001EB58E50000-memory.dmp
memory/996-837-0x000001EB58E30000-0x000001EB58E40000-memory.dmp
memory/996-836-0x000001EB58E20000-0x000001EB58E30000-memory.dmp
memory/996-835-0x000001EB58E10000-0x000001EB58E20000-memory.dmp
memory/996-834-0x000001EB58E00000-0x000001EB58E10000-memory.dmp
memory/996-833-0x000001EB58DF0000-0x000001EB58E00000-memory.dmp
memory/996-832-0x000001EB58DE0000-0x000001EB58DF0000-memory.dmp
memory/996-831-0x000001EB58DD0000-0x000001EB58DE0000-memory.dmp
memory/996-830-0x000001EB58DC0000-0x000001EB58DD0000-memory.dmp
memory/996-829-0x000001EB58DB0000-0x000001EB58DC0000-memory.dmp
memory/996-828-0x000001EB58DA0000-0x000001EB58DB0000-memory.dmp
memory/996-827-0x000001EB58D90000-0x000001EB58DA0000-memory.dmp
memory/996-826-0x000001EB58D80000-0x000001EB58D90000-memory.dmp
memory/996-825-0x000001EB58D60000-0x000001EB58D70000-memory.dmp
memory/996-824-0x000001EB58D70000-0x000001EB58D80000-memory.dmp
memory/996-823-0x000001EB58D50000-0x000001EB58D60000-memory.dmp
memory/996-822-0x000001EB58D40000-0x000001EB58D50000-memory.dmp
memory/996-821-0x000001EB58D30000-0x000001EB58D40000-memory.dmp
memory/996-820-0x000001EB58D20000-0x000001EB58D30000-memory.dmp
memory/996-819-0x000001EB58D10000-0x000001EB58D20000-memory.dmp
memory/996-818-0x000001EB58D00000-0x000001EB58D10000-memory.dmp
memory/996-817-0x000001EB58CF0000-0x000001EB58D00000-memory.dmp
memory/4472-0-0x0000000000400000-0x000000000041F000-memory.dmp