ThreatFox: DCRat IOCs | SOC Hunt Feed

Hunt Hypothesis

This hypothesis targets the presence of known DCRat indicators of compromise, which are frequently used by adversaries to establish persistent footholds and execute malicious payloads within enterprise environments. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate compromised assets before the ransomware-as-a-service tool can propagate laterally or encrypt critical data.

IOC Summary

Malware Family: DCRat Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`82[.]23[.]246[.]148:12159`	botnet_cc	2026-09-05	75%
ip:port	`156[.]238[.]120[.]12:12159`	botnet_cc	2026-09-05	75%
ip:port	`102[.]220[.]160[.]117:80`	botnet_cc	2026-09-05	75%
ip:port	`82[.]23[.]246[.]148:8848`	botnet_cc	2026-09-04	75%
ip:port	`156[.]238[.]120[.]12:8848`	botnet_cc	2026-09-04	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["156.238.120.12", "102.220.160.117", "82.23.246.148"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["156.238.120.12", "102.220.160.117", "82.23.246.148"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — DCRat

False Positive Guidance

Legacy Application Maintenance: A specific line-of-business application (e.g., a custom inventory management system) uses a legacy C++ DLL that shares the same hash or memory footprint as one of the DCRat IOCs during its nightly data synchronization job.
- Filter/Exclusion: Exclude alerts where the process path is under C:\Apps\InventorySync\ AND the parent process is svchost.exe or a specific service executable (e.g., InvSyncSvc.exe).
Third-Party Backup Agent: The enterprise backup solution (e.g., Veeam or Commvault) installs a helper agent that loads a shared library with a known DCRat IOC hash to facilitate deduplication calculations during the daily backup window.
- Filter/Exclusion: Exclude events where the process name is VeeamBackup.exe or CommAgent.exe AND the event type is “Process Loaded” or “Module Loaded”.
Developer Sandbox Environment: A developer on the R&D team is testing a new microservice in a containerized environment (Docker) that includes a debug library matching a DCRat IOC for performance profiling.
- Filter/Exclusion: Exclude alerts originating from hosts tagged with Environment=Dev or Containerized=True, or specifically exclude processes running under dockerd.exe or containerd-shim.
Patch Management Rollback: During a Windows Update rollback, the system temporarily reverts a system DLL to a previous version that matches a DCRat IOC hash, causing a brief detection spike during the TrustedInstaller service operation.
- Filter/Exclusion: Exclude alerts where the parent process is TrustedInstaller.exe AND the event occurs within a 5-minute window following a “Windows Update” or “Patch Management” task completion.
**Anti-Mal