Signed, sealed, injected The mechanics of DCRat in 2026
Overview of DCRat Campaign in 2026
In early 2026, the Trellix Advanced Research Center (ARC) identified and analyzed an active DarkCrystal RAT (DCRat) campaign following a critical customer escalation. The operation relied on a judicial-themed phishing lure, masquerading as an official “Resolución Denuncia Jurídica” (legal complaint resolution) to pressure victims into opening the attachment. Every stage of the attack required human interaction, from opening the phishing email to extracting the archive to executing the malicious components alongside trusted libraries by using DLL sideloading. In its final stage, the malware employed process hollowing to inject malicious code into a trusted system process, effectively evading detection. The end payload was DCRat, granting attackers full remote access and control. This campaign is particularly notable for legitimate, signed utility to bypass traditional security perimeters. 🚀
Attack Chain
This attack chain begins with a deceptive phishing email carrying an SVG attachment, a seemingly harmless vector image that hides embedded JavaScript. Once triggered, the script drops a ZIP archive containing an executable and multiple DLLs. This is a classic example of HTML Smuggling, a technique where an attacker hides a malicious payload inside a seemingly harmless file format, in this case, an SVG file. Because SVGs are essentially XML-based image files that can execute JavaScript, they are perfect “trojan horses” for bypassing email gateways that might block .EXE or .JS files but allow .SVG files. The document deceives the user into initiating a download, and a second page provides a password (1601) to open the file, creating a false sense of legitimacy and security. The embedded JavaScript script uses a Blob function to reconstruct a ZIP file entirely in the browser’s memory, saving it as ‘DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z’ in the user’s downloads folder.
DLL Side-Loading
The ZIP file contains a decoy loader along with several libraries that pretend to be Brotli components. Using Brotli-style names helps the malware blend in and look harmless at first glance. DLL side-loading is a key approach, where the decoy loader intentionally includes malicious DLLs (such as libbrotlidec.dll and libbrotlienc.dll) alongside itself. When the executable is run, Windows’ DLL search order resolves these deceptive Brotli libraries rather than genuine ones, allowing the attacker to execute code disguised as standard compression methods. This method challenges detection because the imports appear legitimate, but the functionality is hijacked. The sample DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.exe imports unusual modules such as libbrotlidec.dll (for decryption) and libbrotlienc.dll (for encryption). After execution, a folder is created in the user directory, dropping a self-copy with its dependency DLLs and a batch script. It also creates a run entry in the Windows Registry for persistence.
Injection Phase
After the payload is decrypted in memory, the injection phase begins. The payload starts a legitimate process, “AddInProcess32.exe,” in a suspended state. It then injects its malicious code into the target process’s memory using WriteProcessMemory, and ResumeThread restarts the process, which now runs the attacker’s code while appearing to be a normal Windows executable. This allows the malware to blend in with trusted system processes and execute stealthily, replacing the original code of that trusted process with its own. The malicious payload is a compact .NET executable functioning as a client stub. It decrypts hidden configuration information, applies anti-analysis and persistence techniques, and persistently attempts to establish an encrypted communication channel with its command-and-control (C2) server. The main function begins with a delay to evade sandbox detection, then loads its settings and runs anti-analysis checks to block debugging or security tools. It ensures only one instance runs via a mutex, and bypasses AMSI to avoid Windows malware scanning.
For more details, check out the full article: Read full article