Analysis
- user interaction
yes - max time kernel
85s - max time network
86s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 12:26
Behavioral task
behavioral1
Sample
DcRat.7z
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
DcRat.7z
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
DcRat.7z
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
DcRat.7z
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target DcRat.7z
- Size 4.0MB
- Sample260809-pl8dsa1sgz
- SHA256 68115c6e039363be3b80e416ed462d97f8c763af800237b1fa183cca1180bac5
- MD5 836c2ae55c1baec789b83fa3d79d23b3
- SHA1 359a091da48369e1e8cea6e004826ee25a93b3db
- SHA512 e12f7438545f6615f84e37b81837127aacc79b4aadd3b212702bb662b0f752778ed15d646e8d657b318dfde57d2f893c18831bfb686a0ae1b7d62137c63080be
- SSDEEP 98304:ZuPQL6HZ4+zkMgDWby//eWG/mdBMXW3Jx3/EI+e+:Zuz4+zyDWbRL2s
- TLSH T12116337960E8DEBC9EACB172D03788D78343904F1ED6E22C25A17546EB63C72D39265C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000700000002443a-33.dat family_asyncrat - Executes dropped EXE 3 IoCs
pid Process 3836 DcRat.exe 2196 DcRat.exe 896 Client.exe - Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 3836 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2196 DcRat.exe 2380 7zFM.exe 2380 7zFM.exe 2380 7zFM.exe 2380 7zFM.exe 2380 7zFM.exe 2380 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2380 7zFM.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2380 7zFM.exe Token: 35 2380 7zFM.exe Token: SeSecurityPrivilege 2380 7zFM.exe Token: SeSecurityPrivilege 2380 7zFM.exe Token: SeDebugPrivilege 3836 DcRat.exe Token: SeDebugPrivilege 2196 DcRat.exe Token: SeSecurityPrivilege 2380 7zFM.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2380 7zFM.exe 2380 7zFM.exe 3836 DcRat.exe 2380 7zFM.exe 2196 DcRat.exe 2380 7zFM.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3836 DcRat.exe 2196 DcRat.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2380 wrote to memory of 3836 2380 7zFM.exe 85 PID 2380 wrote to memory of 2196 2380 7zFM.exe 92 PID 2380 wrote to memory of 896 2380 7zFM.exe 95
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\DcRat.7z"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\7zOC4966B29\DcRat.exe"C:\Users\Admin\AppData\Local\Temp\7zOC4966B29\DcRat.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3836
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC4978209\DcRat.exe"C:\Users\Admin\AppData\Local\Temp\7zOC4978209\DcRat.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2196
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC499F0B9\Client.exe"C:\Users\Admin\AppData\Local\Temp\7zOC499F0B9\Client.exe"2⤵
- Executes dropped EXE
PID:896
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:4324
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DcRat.exe.log
- Size 1KB
- SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
- MD5 baf55b95da4a601229647f25dad12878
- SHA1 abc16954ebfd213733c4493fc1910164d825cac8
- SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
- TLSH T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zOC4966B29\DcRat.exe
- Size 12.3MB
- SHA256 c73b1ffa39c5843b2ed951ac48350d1deb33db4057341f1dab1ee64ea1a62248
- MD5 7fce411ea2b74f227489659113960b18
- SHA1 543d95b74193a188fe273ce7b065aa177405beb5
- SHA512 42de7bc4a0b47e1053ff3ff52a3f887e56759f81cfa691996a533d769e80f98b3e8dcf869785fce801d9cc7a2bc3d675e2eb832b520846b053d6b07093be2678
- SSDEEP 196608:XtfZFB2gaNIsNNNNKmvN8rNNNNNNNNNNHbL7aIXM1B7Z0/3G6tULs8wR:XlT81Bd+3G6
- TLSH T182D67D01FAA4C552D07A62F6D4E20AF457B0AE69EB119BBB21843FA83DF37407C15367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zOC499F0B9\Client.exe
- Size 45KB
- SHA256 f003f20a3f57d41c72f2874a889a7a2a8e396a57f42cce35fbed9869c6a01964
- MD5 c007eafb83bde10955e1fb1f559a207e
- SHA1 5dcf9702941e41c01fc0a8379df21a5691fa1b5f
- SHA512 cd25e388f06a313fb35abb7fc66d1f01c3df18a9ae01e9e2a8d005f44a749d8151650f01d32af83dc23e09ec3b3a6ce3e5a33c8bc1a32c883f848445714fbba6
- SSDEEP 768:+x6KCL3NdW2rIRpOHet/P5+/dSicaKe1Vvgc0WpmE1I5JVc6KN:+x6bNan5+MicaKe1VH0iX8JVclN
- TLSH T1A5236D103FE8817AD2AD06B868B3431447B9C5A76413DF5F7CC854AA1B13BCA97227DB
- MD5 SHA1 SHA512 SSDEEP TLSH