Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10DcRat.zip
windows10-2004-x64
10BackupCertificate.zip
windows10-2004-x64
1ServerCertificate.p12
windows10-2004-x64
7DcRat.exe
windows10-2004-x64
10DcRat.exe.xml
windows10-2004-x64
1Plugins/Audio.dll
windows10-2004-x64
1Plugins/Chat.dll
windows10-2004-x64
1Plugins/Extra.dll
windows10-2004-x64
1Plugins/Fi...er.dll
windows10-2004-x64
1Plugins/Fi...er.dll
windows10-2004-x64
1Plugins/Fun.dll
windows10-2004-x64
1Plugins/In...on.dll
windows10-2004-x64
1Plugins/Keylogger.exe
windows10-2004-x64
1Plugins/Logger.dll
windows10-2004-x64
1Plugins/Mi...us.dll
windows10-2004-x64
1Plugins/Netstat.dll
windows10-2004-x64
1Plugins/Options.dll
windows10-2004-x64
1Plugins/Pr...er.dll
windows10-2004-x64
1Plugins/Ra...re.dll
windows10-2004-x64
1Plugins/Recovery.dll
windows10-2004-x64
1Plugins/Regedit.dll
windows10-2004-x64
1Plugins/Re...ra.dll
windows10-2004-x64
1Plugins/Re...op.dll
windows10-2004-x64
1Plugins/SendFile.dll
windows10-2004-x64
1Plugins/Se...ry.dll
windows10-2004-x64
1ServerCertificate.p12
windows10-2004-x64
7Stub/Client.exe
windows10-2004-x64
10project2.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2024, 20:13
Behavioral task
behavioral1
Sample
DcRat.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
BackupCertificate.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
ServerCertificate.p12
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
DcRat.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
DcRat.exe.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
Plugins/Audio.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Plugins/Chat.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
Plugins/Extra.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Plugins/FileManager.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
Plugins/FileSearcher.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Plugins/Fun.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
Plugins/Information.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Plugins/Keylogger.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
Plugins/Logger.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Plugins/Miscellaneous.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
Plugins/Netstat.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Plugins/Options.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
Plugins/ProcessManager.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Plugins/Ransomware.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
Plugins/Recovery.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Plugins/Regedit.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
Plugins/RemoteCamera.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Plugins/RemoteDesktop.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
Plugins/SendFile.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Plugins/SendMemory.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
ServerCertificate.p12
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Stub/Client.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
project2.dll
Resource
win10v2004-20241007-en
General
-
Target
ServerCertificate.p12
-
Size
1KB
-
MD5
fd7325f2ee4701b301b32f334ea68f6b
-
SHA1
7b6fb952296069aa735573f4040aedb5fe42b21b
-
SHA256
ae005aa9e6bc53ffbce04c90f5160124cc6944d2959f1e1a46e3d7626d9cb5a6
-
SHA512
6d1fac63a963ce8c680aae2462ee406b6c370949e64061cc7c8925bc8c928d52b51173e977327ff1b093d68492f3ea2fe6e1be08f38876edf46873912906a654
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\certmgr.msc mmc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1480 mmc.exe Token: SeIncBasePriorityPrivilege 1480 mmc.exe Token: 33 1480 mmc.exe Token: SeIncBasePriorityPrivilege 1480 mmc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1480 mmc.exe 1480 mmc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4696 wrote to memory of 1480 4696 rundll32.exe 84 PID 4696 wrote to memory of 1480 4696 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX C:\Users\Admin\AppData\Local\Temp\ServerCertificate.p121⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\System32\mmc.exe"C:\Windows\System32\mmc.exe" C:\Windows\system32\certmgr.msc /certmgr:FileName="C:\Users\Admin\AppData\Local\Temp\ServerCertificate.p12"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1480
-