68115c6e039363be3b80e416ed462d97f8c763af800237b1fa183cca1180bac5 | Triage

Analysis

max time kernel
638s
max time network
435s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
31-12-2024 00:30

Sharing

Report Analysis Logs

General

Target

DcRat.7z
Size

4.0MB
MD5

836c2ae55c1baec789b83fa3d79d23b3
SHA1

359a091da48369e1e8cea6e004826ee25a93b3db
SHA256

68115c6e039363be3b80e416ed462d97f8c763af800237b1fa183cca1180bac5
SHA512

e12f7438545f6615f84e37b81837127aacc79b4aadd3b212702bb662b0f752778ed15d646e8d657b318dfde57d2f893c18831bfb686a0ae1b7d62137c63080be
SSDEEP

98304:ZuPQL6HZ4+zkMgDWby//eWG/mdBMXW3Jx3/EI+e+:Zuz4+zyDWbRL2s

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5064	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	5064	7zFM.exe
Token: 35	5064	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5064	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\DcRat.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads