Analysis
-
max time kernel
14s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 16:51
General
-
Target
DcRat (1).7z
-
Size
4.0MB
-
MD5
836c2ae55c1baec789b83fa3d79d23b3
-
SHA1
359a091da48369e1e8cea6e004826ee25a93b3db
-
SHA256
68115c6e039363be3b80e416ed462d97f8c763af800237b1fa183cca1180bac5
-
SHA512
e12f7438545f6615f84e37b81837127aacc79b4aadd3b212702bb662b0f752778ed15d646e8d657b318dfde57d2f893c18831bfb686a0ae1b7d62137c63080be
-
SSDEEP
98304:ZuPQL6HZ4+zkMgDWby//eWG/mdBMXW3Jx3/EI+e+:Zuz4+zyDWbRL2s
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\DcRat (1).7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Release\DcRat.exe"C:\Users\Admin\Desktop\Release\DcRat.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.3MB
MD57fce411ea2b74f227489659113960b18
SHA1543d95b74193a188fe273ce7b065aa177405beb5
SHA256c73b1ffa39c5843b2ed951ac48350d1deb33db4057341f1dab1ee64ea1a62248
SHA51242de7bc4a0b47e1053ff3ff52a3f887e56759f81cfa691996a533d769e80f98b3e8dcf869785fce801d9cc7a2bc3d675e2eb832b520846b053d6b07093be2678
-
Filesize
5KB
MD5f8806ec6bcfeda3bfaab9821506ef15c
SHA1ede84267e6df98f8c60ecdb72a1546013cb4ba3b
SHA256dc698c4a2c1b33a2e449f4f4c8ef6058c325b4125584a70b71efde05715b78e7
SHA5122617bd0917f5de770c06adec6484ffd2b34406e6708c67929192531bd95eed9e216825909f610573dd6bbef64870c6a7c5801d9d201c0d98010fc634b8f28477
-
Filesize
8KB
-
Filesize
12.3MB
-
Filesize
10.8MB