Analysis
- user interaction
yes - max time kernel
54s - max time network
50s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 15:26
General
- Target DcRat.exe
- Size 21.6MB
- Sample260930-sve1dabe67
- SHA256 533c45a3400cceaf13703564aa125c4a17b613ea0964d140be0415d7df4f644b
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DcRat.exe"C:\Users\Admin\AppData\Local\Temp\DcRat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
user.config
memory/4696-7-0x000002A2C3710000-0x000002A2C371A000-memory.dmp
memory/4696-18-0x000002A2A7BA0000-0x000002A2A7BB0000-memory.dmp
memory/4696-3-0x000002A2A7BA0000-0x000002A2A7BB0000-memory.dmp
memory/4696-5-0x000002A2A7BA0000-0x000002A2A7BB0000-memory.dmp
memory/4696-6-0x000002A2A7BA0000-0x000002A2A7BB0000-memory.dmp
memory/4696-0-0x000002A2A6230000-0x000002A2A77CE000-memory.dmp
memory/4696-10-0x000002A2C3790000-0x000002A2C37A2000-memory.dmp
memory/4696-2-0x000002A2A7BA0000-0x000002A2A7BB0000-memory.dmp
memory/4696-19-0x000002A2C37B0000-0x000002A2C37D4000-memory.dmp
memory/4696-1-0x000002A2A7BA0000-0x000002A2A7BB0000-memory.dmp
memory/4696-33-0x000002A2A7BA0000-0x000002A2A7BB0000-memory.dmp
memory/4696-34-0x000002A2A7BA0000-0x000002A2A7BB0000-memory.dmp
memory/4696-35-0x000002A2C37B0000-0x000002A2C37D4000-memory.dmp
memory/4696-37-0x000002A2C37B0000-0x000002A2C37D4000-memory.dmp