Overview
overview
7Static
static
3newdcnyash/DCRat.exe
windows11-21h2-x64
6newdcnyash...xa.dll
windows11-21h2-x64
3newdcnyash...BC.exe
windows11-21h2-x64
1newdcnyash...BT.exe
windows11-21h2-x64
1newdcnyash...LC.exe
windows11-21h2-x64
1newdcnyash...lt.exe
windows11-21h2-x64
1newdcnyash...C3.dll
windows11-21h2-x64
3newdcnyash...xt.dll
windows11-21h2-x64
3newdcnyash...64.dll
windows11-21h2-x64
3newdcnyash...on.exe
windows11-21h2-x64
1newdcnyash...ip.exe
windows11-21h2-x64
1newdcnyash...ib.dll
windows11-21h2-x64
1newdcnyash...le.exe
windows11-21h2-x64
7newdcnyash...or.exe
windows11-21h2-x64
7newdcnyash...nc.vbe
windows11-21h2-x64
1newdcnyash...ss.exe
windows11-21h2-x64
1newdcnyash...ar.exe
windows11-21h2-x64
3newdcnyash...ar.exe
windows11-21h2-x64
5newdcnyash...ce.exe
windows11-21h2-x64
7newdcnyash...lI.jar
windows11-21h2-x64
1newdcnyash...II.jar
windows11-21h2-x64
1newdcnyash...Il.jar
windows11-21h2-x64
1newdcnyash...II.jar
windows11-21h2-x64
1newdcnyash...II.jar
windows11-21h2-x64
1newdcnyash...ll.jar
windows11-21h2-x64
7newdcnyash...ll.jar
windows11-21h2-x64
1newdcnyash...ll.jar
windows11-21h2-x64
1newdcnyash...lI.jar
windows11-21h2-x64
1newdcnyash...lI.jar
windows11-21h2-x64
1newdcnyash...ll.jar
windows11-21h2-x64
1newdcnyash...II.jar
windows11-21h2-x64
1newdcnyash...er.bat
windows11-21h2-x64
7Analysis
-
max time kernel
54s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-07-2024 04:32
Static task
static1
Behavioral task
behavioral1
Sample
newdcnyash/DCRat.exe
Resource
win11-20240704-en
Behavioral task
behavioral2
Sample
newdcnyash/data/7zxa.dll
Resource
win11-20240704-en
Behavioral task
behavioral3
Sample
newdcnyash/data/DCRBC.exe
Resource
win11-20240704-en
Behavioral task
behavioral4
Sample
newdcnyash/data/DCRBT.exe
Resource
win11-20240704-en
Behavioral task
behavioral5
Sample
newdcnyash/data/DCRLC.exe
Resource
win11-20240704-en
Behavioral task
behavioral6
Sample
newdcnyash/data/Default.exe
Resource
win11-20240704-en
Behavioral task
behavioral7
Sample
newdcnyash/data/NCC3.dll
Resource
win11-20240704-en
Behavioral task
behavioral8
Sample
newdcnyash/data/RarExt.dll
Resource
win11-20240704-en
Behavioral task
behavioral9
Sample
newdcnyash/data/RarExt64.dll
Resource
win11-20240704-en
Behavioral task
behavioral10
Sample
newdcnyash/data/WinCon.exe
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
newdcnyash/data/Zip.exe
Resource
win11-20240704-en
Behavioral task
behavioral12
Sample
newdcnyash/data/dnlib.dll
Resource
win11-20240704-en
Behavioral task
behavioral13
Sample
newdcnyash/data/dotNET_Reactor.Console.exe
Resource
win11-20240704-en
Behavioral task
behavioral14
Sample
newdcnyash/data/dotNET_Reactor.exe
Resource
win11-20240704-en
Behavioral task
behavioral15
Sample
newdcnyash/data/enc.vbe
Resource
win11-20240704-en
Behavioral task
behavioral16
Sample
newdcnyash/data/mpress.exe
Resource
win11-20240704-en
Behavioral task
behavioral17
Sample
newdcnyash/data/rar.exe
Resource
win11-20240704-en
Behavioral task
behavioral18
Sample
newdcnyash/data/wrar.exe
Resource
win11-20240704-en
Behavioral task
behavioral19
Sample
newdcnyash/dcrat_updservice.exe
Resource
win11-20240704-en
Behavioral task
behavioral20
Sample
newdcnyash/lib/IIlIllIIlIllllIIIlIIlllIIIIIlIlllIIIIllllllIlIIlllIlIlIlllIIIlIIllIIIIlIllIlIlIlIlIlI.jar
Resource
win11-20240704-en
Behavioral task
behavioral21
Sample
newdcnyash/lib/IIllIIIIIlIlIIlIIIllIllllIIIlllIIIlIlIIlIlIllllIIlIIllIlIlIllIIIIIlIlllllllIIIIlIIlII.jar
Resource
win11-20240704-en
Behavioral task
behavioral22
Sample
newdcnyash/lib/IlIIIIllIIIIIIIIIllIlIllIIIlIIllIIlIIllIIlIlIIIIIIIIIIlllIIlIllIIIlIlIllIllIlIlIlIlIl.jar
Resource
win11-20240704-en
Behavioral task
behavioral23
Sample
newdcnyash/lib/IlIlIIIIIIlIIIIIIllIlIIlIllIllIlIIIlIllllIlIlllIIlIIllIllIIlIlllIIIllllIlIllIIIIIIIII.jar
Resource
win11-20240704-en
Behavioral task
behavioral24
Sample
newdcnyash/lib/IllIIIIIIIlllIIIlIlIllIIIIIllIllIlIIlIllIlIIlIllIIlIlIlIlllllllIIlllllllIIlIIIlIlIlII.jar
Resource
win11-20240704-en
Behavioral task
behavioral25
Sample
newdcnyash/lib/IllIIIIIIlIIIIIlIllIIIIlIlIIIIlIIllIIllIIlIlllIlIlIlIIIlllllIlllIllIIIlllllIlIlIlIlll.jar
Resource
win11-20240508-en
Behavioral task
behavioral26
Sample
newdcnyash/lib/IlllIIlllllIIllIIIlIIlIlIlIllllIlllIllllIIIIIlIllIIIIllIIlllIllIlIlIlIIIIllIllIIlllll.jar
Resource
win11-20240704-en
Behavioral task
behavioral27
Sample
newdcnyash/lib/lIIIIIIllIllllllIIlllIlIIIIlIIllllIIIIIIIIllIIIIIlIIIIIIIlllIIIIIIlIIIlIlIlIlIlIllIll.jar
Resource
win11-20240704-en
Behavioral task
behavioral28
Sample
newdcnyash/lib/lIIlIIlllIIIIIIlllIllIIIlIlIllIlllIlIllIllllIllIIIlIlIIIlIllIllIIlllIlllllIIIlIIlIIlI.jar
Resource
win11-20240704-en
Behavioral task
behavioral29
Sample
newdcnyash/lib/lIlllIIlIIlllIIllIIIlIIIIIlIlIlIIIIlIllIIlllIlllIllIlllIlIlIlllIIllIIllIIIlIllIIIlllI.jar
Resource
win11-20240704-en
Behavioral task
behavioral30
Sample
newdcnyash/lib/llIlIlIIlllIllIlllIlIIIlIIIIlllIIIllIllllIIIIIIIIlllIlIIlllIIllIIllIlIIIllIIIIlIIlIll.jar
Resource
win11-20240704-en
Behavioral task
behavioral31
Sample
newdcnyash/lib/llIlIllIllIllIlIlllIlllIIIllllllIlIIlIllIlIlIlllIllIIIIIlllIIlIIlIllllIIIlllIllIIlIII.jar
Resource
win11-20240704-en
General
-
Target
newdcnyash/data/dotNET_Reactor.exe
-
Size
13.3MB
-
MD5
bd73df4cf427511993075f7a16e037a5
-
SHA1
63f116641b0655f53e93d62ae559d510ed5af134
-
SHA256
fa0a32d408a8df70ec44f3d2374b058f57b86ff49b8068b8c68f8505d3463970
-
SHA512
49ad63e65e1f6a454778c904727c948969145eb09457105093af463d933413a7d30437051c7ddb8ded0b46d38b2018a1a78c83af582ab6775bef870057a9dfc3
-
SSDEEP
393216:xfuP82nPJiP63TKZqkoPrSz4rkZD1K1fU:xqPIPgTxkqrV6YN
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral14/memory/3972-2-0x0000000000590000-0x000000000183A000-memory.dmp net_reactor -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
dotNET_Reactor.exepid process 3972 dotNET_Reactor.exe 3972 dotNET_Reactor.exe 3972 dotNET_Reactor.exe 3972 dotNET_Reactor.exe 3972 dotNET_Reactor.exe 3972 dotNET_Reactor.exe 3972 dotNET_Reactor.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
dotNET_Reactor.exepid process 3972 dotNET_Reactor.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3972-0-0x0000000000590000-0x000000000183A000-memory.dmpFilesize
18.7MB
-
memory/3972-1-0x0000000073E0E000-0x0000000073E0F000-memory.dmpFilesize
4KB
-
memory/3972-2-0x0000000000590000-0x000000000183A000-memory.dmpFilesize
18.7MB
-
memory/3972-3-0x0000000073E00000-0x00000000745B1000-memory.dmpFilesize
7.7MB
-
memory/3972-4-0x00000000070C0000-0x0000000007666000-memory.dmpFilesize
5.6MB
-
memory/3972-5-0x0000000006C90000-0x0000000006CF6000-memory.dmpFilesize
408KB
-
memory/3972-6-0x0000000007A50000-0x0000000007AE2000-memory.dmpFilesize
584KB
-
memory/3972-17-0x000000000B7F0000-0x000000000B7F8000-memory.dmpFilesize
32KB
-
memory/3972-19-0x000000000BD90000-0x000000000BD9E000-memory.dmpFilesize
56KB
-
memory/3972-18-0x000000000BDC0000-0x000000000BDF8000-memory.dmpFilesize
224KB
-
memory/3972-20-0x0000000073E00000-0x00000000745B1000-memory.dmpFilesize
7.7MB
-
memory/3972-21-0x0000000073E00000-0x00000000745B1000-memory.dmpFilesize
7.7MB
-
memory/3972-22-0x000000000CA90000-0x000000000CAD0000-memory.dmpFilesize
256KB
-
memory/3972-28-0x0000000000590000-0x000000000183A000-memory.dmpFilesize
18.7MB
-
memory/3972-30-0x0000000073E0E000-0x0000000073E0F000-memory.dmpFilesize
4KB
-
memory/3972-31-0x0000000073E00000-0x00000000745B1000-memory.dmpFilesize
7.7MB
-
memory/3972-32-0x0000000073E00000-0x00000000745B1000-memory.dmpFilesize
7.7MB