Resubmissions

19/05/2025, 16:23

250519-tv14aabn4v 10

19/05/2025, 16:19

250519-tsnp6s1ly4 10

General

  • Target

    https://github.com/qwqdanchun/DcRat

  • Sample

    250519-tv14aabn4v

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

127.0.0.1:8848

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Modifies Windows Defender DisableAntiSpyware settings

    • Modifies Windows Defender Real-time Protection settings

    • Async RAT payload

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Renames multiple (348) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

    • Network Service Discovery

      Attempt to gather information on host's network.

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks