Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
13/07/2024, 19:15
General
- Target Release/DcRat.exe
- Size 12.3MB
- Sample240713-xx84fstemj
- SHA256 c73b1ffa39c5843b2ed951ac48350d1deb33db4057341f1dab1ee64ea1a62248
Malware Config
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Release\DcRat.exe"C:\Users\Admin\AppData\Local\Temp\Release\DcRat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3516-0-0x00007FFBABAD3000-0x00007FFBABAD5000-memory.dmp
memory/3516-1-0x000001E282490000-0x000001E2830DA000-memory.dmp
memory/3516-2-0x00007FFBABAD0000-0x00007FFBAC591000-memory.dmp
memory/3516-3-0x00007FFBABAD0000-0x00007FFBAC591000-memory.dmp
memory/3516-4-0x00007FFBABAD0000-0x00007FFBAC591000-memory.dmp
memory/3516-5-0x000001E29D980000-0x000001E29D98A000-memory.dmp
memory/3516-6-0x00007FFBABAD0000-0x00007FFBAC591000-memory.dmp
memory/3516-7-0x000001E29FEA0000-0x000001E29FEB2000-memory.dmp
memory/3516-15-0x00007FFBABAD3000-0x00007FFBABAD5000-memory.dmp
memory/3516-16-0x00007FFBABAD0000-0x00007FFBAC591000-memory.dmp
memory/3516-17-0x00007FFBABAD0000-0x00007FFBAC591000-memory.dmp
memory/3516-18-0x00007FFBABAD0000-0x00007FFBAC591000-memory.dmp
memory/3516-19-0x00007FFBABAD0000-0x00007FFBAC591000-memory.dmp