Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
20/07/2024, 09:53
General
- Target DcRat.exe
- Size 21.6MB
- Sample240720-lwt3cswhpl
- SHA256 533c45a3400cceaf13703564aa125c4a17b613ea0964d140be0415d7df4f644b
Malware Config
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DcRat.exe"C:\Users\Admin\AppData\Local\Temp\DcRat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1812-0-0x00007FFBBAF33000-0x00007FFBBAF35000-memory.dmp
memory/1812-1-0x0000017962070000-0x000001796360E000-memory.dmp
memory/1812-2-0x00007FFBBAF30000-0x00007FFBBB9F1000-memory.dmp
memory/1812-3-0x00007FFBBAF30000-0x00007FFBBB9F1000-memory.dmp
memory/1812-4-0x00007FFBBAF30000-0x00007FFBBB9F1000-memory.dmp
memory/1812-6-0x0000017965470000-0x000001796547A000-memory.dmp
memory/1812-7-0x00007FFBBAF30000-0x00007FFBBB9F1000-memory.dmp
memory/1812-8-0x000001797DF30000-0x000001797DF42000-memory.dmp
memory/1812-16-0x00007FFBBAF33000-0x00007FFBBAF35000-memory.dmp
memory/1812-17-0x00007FFBBAF30000-0x00007FFBBB9F1000-memory.dmp
memory/1812-18-0x00007FFBBAF30000-0x00007FFBBB9F1000-memory.dmp
memory/1812-19-0x00007FFBBAF30000-0x00007FFBBB9F1000-memory.dmp
memory/1812-20-0x00007FFBBAF30000-0x00007FFBBB9F1000-memory.dmp