Analysis
- user interaction
yes - max time kernel
39s - max time network
40s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
05/05/2026, 17:32
General
- Target Arcane Fn.exe
- Size 56KB
- Sample260505-v4dvsags2k
- SHA256 1cdd311d7420195a73732d74b2f61cdb4ecf7f894bd9e4fd3925225451dbb516
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Arcane Fn.exe"C:\Users\Admin\AppData\Local\Temp\Arcane Fn.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\ktmutil.exe"C:\Windows\System32\ktmutil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2428-28-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-35-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-12-0x000002363FBA0000-0x000002363FBA1000-memory.dmp
memory/2428-18-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-30-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-34-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-29-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-36-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-32-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-31-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-11-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-33-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-25-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-26-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-24-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-27-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-47-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-23-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-38-0x000002363FE20000-0x000002363FE21000-memory.dmp
memory/2428-39-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-40-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-41-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/2428-43-0x000002363F470000-0x000002363FB9E000-memory.dmp
memory/3496-6-0x0000014D73990000-0x0000014D7399C000-memory.dmp