The attack ultimately hides a remote-access trojan inside a legitimate Windows-related process, helping it blend into normal endpoint activity.
The campaign uses a fake legal-notice lure named “Resolución Denuncia Jurídica,” designed to exploit fear and urgency. Victims receive a phishing email with an SVG attachment that appears harmless but contains embedded JavaScript.
When opened, the SVG directs users to a fake Colombian judicial portal and creates a password-protected archive named DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z.
The JavaScript is double Base64-encoded and reconstructs the archive in the browser using a Blob object.
This is a form of HTML smuggling, where malicious content is concealed inside a file type that may pass through email security controls more easily than executable files.
DCRat Hides Inside Windows
The archive contains a decoy executable, supporting DLL files, and a hidden malware chain. The loader uses names associated with Brotli, a legitimate compression technology, including libbrotlidec.dll and libbrotlienc.dll.
These names make the files appear less suspicious to victims and analysts. When the victim launches the decoy executable, Windows searches the local directory for required DLLs.
The malware abuses this behavior by placing malicious DLLs next to the executable. Instead of loading legitimate Brotli libraries, the program loads attacker-controlled versions.
This technique, known as DLL sideloading, allows malicious code to execute under the appearance of a trusted application.
The loader then creates a folder in the user profile, copies itself and its dependencies there, and writes a batch script. It establishes persistence through a Registry Run key, enabling the malware to restart when the user logs in.
During execution, the loader decrypts an embedded payload stored in its .rdata section.
The decrypted data reveals standard MZ and PE headers, confirming that a Windows executable has been reconstructed directly in memory. This reduces the amount of suspicious payload content written to disk.
After decrypting the payload, the malware launches AddInProcess32.exe in a suspended state. It uses Windows APIs such as CreateProcessInternalW, WriteProcessMemory, Wow64GetThreadContext, Wow64SetThreadContext, and ResumeThread to replace the legitimate process code with its own.
This process hollowing technique makes the malicious payload appear to security tools as a normal trusted process.
Although AddInProcess32.exe remains visible in process listings, its memory contains DCRat code rather than its original instructions. The final DCRat payload is a compact .NET client stub.
It performs anti-analysis checks, delays execution to evade sandbox environments, creates a mutex named DcRatMutex_qwqdanchun, bypasses AMSI protections, and attempts to maintain persistence.
It also collects a hardware identifier and decrypts its configuration at runtime using AES-256, trellix said.
Indicators of Compromise
| Type | Indicator | Description |
|---|---|---|
| Email hash | F205AB7E6AEFC10B9833D1A9A91BAD02 | Phishing email carrying the judicial-themed lure |
| Email filename | ENVIO DE RESOLUCION DENUNCIA JUDICIAL RA-093-7397.eml | Malicious phishing email file |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
