Managed XDR

raid-kostada2-outputs_...5dfbb9b81c64d21c10_adv (DCRat) — malware analysis report

File info

Filename
raid-kostada2-outputs_reduced_dataset-gamma_sections_1772793660-bazaar.2023.01__heur-backdoor.msil.dcrat_dcrat.gen-6ae816ec46ae1900c7a334251d27c93c9b793ee77b521b5dfbb9b81c64d21c10_adv
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size
2.4 MB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
a6aa681aaba4375f92d97446fb9f8e68a7d9b9ee
SHA256
2fd371670f33c566bbe0b7dbe79bc31e5370e9f1154d1b1ccc89e6ed315bc944
MD5
b0196a6bdeb891a0a81e320acaec40e2

Malwares

  • DCRat

Signatures

Execution

T1047 antivm_wmi: Uses WMI to detect virtual environment
T1047 has_wmi: Executes one or several WMI requests
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1027.002 pe_features: Executable file has PE anomalies (may be false positive)
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1497.002 antivm_usbstor: Reads information about usbdevices from regkey
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Discovery

T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1082 has_wmi: Executes one or several WMI requests
T1518 locates_browser: Attempts to identify where browsers are installed
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1497.002 antivm_usbstor: Reads information about usbdevices from regkey

Command and Control

T1071.001 network_http: Performs HTTP requests

Other

yara_rules: Static rules
network_bind: Starts servers listening at None
create_rpc_bindings: Creates RPC connection
dotnet_suspicious_module_name: Dotnet program has suspicious module name
creates_suspended_process: Creates suspended process
dotnet_import_unmanaged_code: Dotnet program statically imports unmanaged functions/modules
message_box: Displays a message
suspicious_network_port: Performs TCP or UDP request to non-standard port
test_check_service: Starts services
writes_data: Writes big amount of data to disk
dotnet_suspicious_entrypoint: Dotnet program has suspicious entrypoint
js_suspicious: Suspicious javascript

Related reports

Managed XDR