68115c6e039363be3b80e416ed462d97f8c763af800237b1fa183cca1180bac5

Analysis

user interaction
yes
max time kernel
86s
max time network
89s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DcRat.7z
Size 4.0MB
Sample260809-pl8dsa1sgz
SHA256 68115c6e039363be3b80e416ed462d97f8c763af800237b1fa183cca1180bac5
MD5 836c2ae55c1baec789b83fa3d79d23b3
SHA1 359a091da48369e1e8cea6e004826ee25a93b3db
SHA512 e12f7438545f6615f84e37b81837127aacc79b4aadd3b212702bb662b0f752778ed15d646e8d657b318dfde57d2f893c18831bfb686a0ae1b7d62137c63080be
SSDEEP 98304:ZuPQL6HZ4+zkMgDWby//eWG/mdBMXW3Jx3/EI+e+:Zuz4+zyDWbRL2s
TLSH
T12116337960E8DEBC9EACB172D03788D78343904F1ED6E22C25A17546EB63C72D39265C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
5032	Keylogger.exe
1900	Keylogger.exe
1748	Keylogger.exe
1404	Keylogger.exe
5080	Keylogger.exe
3400	Keylogger.exe
5160	Keylogger.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5032	Keylogger.exe
1900	Keylogger.exe
1748	Keylogger.exe
1404	Keylogger.exe
5080	Keylogger.exe
3400	Keylogger.exe
5160	Keylogger.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5072	7zFM.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	5072	7zFM.exe
Token: 35	5072	7zFM.exe
Token: SeSecurityPrivilege	5072	7zFM.exe
Token: SeDebugPrivilege	5032	Keylogger.exe
Token: SeSecurityPrivilege	5072	7zFM.exe
Token: SeDebugPrivilege	1900	Keylogger.exe
Token: SeSecurityPrivilege	5072	7zFM.exe
Token: SeDebugPrivilege	1748	Keylogger.exe
Token: SeSecurityPrivilege	5072	7zFM.exe
Token: SeDebugPrivilege	1404	Keylogger.exe
Token: SeSecurityPrivilege	5072	7zFM.exe
Token: SeDebugPrivilege	5080	Keylogger.exe
Token: SeSecurityPrivilege	5072	7zFM.exe
Token: SeDebugPrivilege	3400	Keylogger.exe
Token: SeSecurityPrivilege	5072	7zFM.exe
Token: SeDebugPrivilege	5160	Keylogger.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
5072	7zFM.exe
5072	7zFM.exe
5072	7zFM.exe
5072	7zFM.exe
5072	7zFM.exe
5072	7zFM.exe
5072	7zFM.exe
5072	7zFM.exe
5072	7zFM.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5032	Keylogger.exe
1900	Keylogger.exe
1748	Keylogger.exe
1404	Keylogger.exe
5080	Keylogger.exe
3400	Keylogger.exe
5160	Keylogger.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 5032	5072	7zFM.exe	91
PID 5072 wrote to memory of 1900	5072	7zFM.exe	93
PID 5072 wrote to memory of 1748	5072	7zFM.exe	94
PID 5072 wrote to memory of 1404	5072	7zFM.exe	95
PID 5072 wrote to memory of 5080	5072	7zFM.exe	96
PID 5072 wrote to memory of 3400	5072	7zFM.exe	97
PID 5072 wrote to memory of 5160	5072	7zFM.exe	98

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\DcRat.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\7zO0D3D1A98\Keylogger.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0D3D1A98\Keylogger.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5032
- C:\Users\Admin\AppData\Local\Temp\7zO0D312759\Keylogger.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0D312759\Keylogger.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\7zO0D3D0159\Keylogger.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0D3D0159\Keylogger.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1748
- C:\Users\Admin\AppData\Local\Temp\7zO0D3D5969\Keylogger.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0D3D5969\Keylogger.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1404
- C:\Users\Admin\AppData\Local\Temp\7zO0D3A9769\Keylogger.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0D3A9769\Keylogger.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5080
- C:\Users\Admin\AppData\Local\Temp\7zO0D3E8569\Keylogger.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0D3E8569\Keylogger.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3400
- C:\Users\Admin\AppData\Local\Temp\7zO0D316269\Keylogger.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0D316269\Keylogger.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Keylogger.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO0D3D1A98\Keylogger.exe
Size 10KB
SHA256 4d8c478eb9b6d2128be7d43be944b125700a8f505ef7951679c974617898a03c
MD5 29104fc09f07bfe4dbb67b1158c295e4
SHA1 4386610fd26b3c146838fb321626fcf776e2c803
SHA512 d72ef8d451cb49ae7af84811f1f2d785390fce36bcfa544505647ab123e506975f5fbd8bdeb17706a497e2a705a5d0aaf6f6058e54dac26724ff8439f3cbf928
SSDEEP 192:jtmcuq6MYDxi4maEYbRzmEsLkTgv5JHTZeJYHcwY7fazhEi:jtlF6MWE9rUhVsL15pZrYylE
TLSH
T1D6221A81B7E89775DD792BB6ACB307501A70E2055C73C9AF1898111E3EA73450F83BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5032-15-0x00000000009F0000-0x00000000009F8000-memory.dmp

Download

memory/5032-16-0x000000001B560000-0x000000001B570000-memory.dmp

Download

memory/5032-17-0x000000001B560000-0x000000001B570000-memory.dmp

Download