darksiderat | df9ef432a54a9a7bd9987041556d860427fc0f95414eede0343c63d4d9e14ae0

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
START_X64.EXE.exe
Size 1.2MB
Sample260705-xp1gcae18t
SHA256 df9ef432a54a9a7bd9987041556d860427fc0f95414eede0343c63d4d9e14ae0
MD5 6d4797f6d2e9925704d6392ef7e126d1
SHA1 e2e5edeca9e72606be459da5cda79b7cbb00ed28
SHA512 60580a88e03bf203ff82e9b3fdbccfc5f0b42b6ed493b52985693ec0d3e0d86ae6f5e85cd09249abf3dce923ec68e33014404ba7ef3a18965d4c9e4cf4727573
SSDEEP 24576:q94T3HFw+ra5XeQ5XFGq3rx0llzBf9xSFF5ywD:q6T3lGe4XEq3rx0llzBf9xSFnyw
TLSH
T1715528B3A5BD8147ECB4D03586238FB14725F6DC5244AB8760E5E4BCBF07A627E5230A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5db-19.dat	family_darksiderat

Executes dropped EXE 1 IoCs

pid	Process
3860	ox_1783278152499.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	6096	START_X64.EXE.exe
Token: SeRestorePrivilege	6096	START_X64.EXE.exe
Token: SeBackupPrivilege	6096	START_X64.EXE.exe
Token: SeSecurityPrivilege	6096	START_X64.EXE.exe
Token: SeTcbPrivilege	6096	START_X64.EXE.exe
Token: SeImpersonatePrivilege	6096	START_X64.EXE.exe
Token: SeAssignPrimaryTokenPrivilege	6096	START_X64.EXE.exe
Token: SeCreateTokenPrivilege	6096	START_X64.EXE.exe
Token: SeShutdownPrivilege	6096	START_X64.EXE.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6096	START_X64.EXE.exe
6096	START_X64.EXE.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6096 wrote to memory of 4412	6096	START_X64.EXE.exe	89
PID 4412 wrote to memory of 3860	4412	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\START_X64.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\START_X64.EXE.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1783278152499.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Users\Admin\AppData\Local\Temp\ox_1783278152499.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1783278152499.exe
    3⤵
    - Executes dropped EXE
    PID:3860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ox_1783278152499.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1783278152499.exe
Size 67KB
SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
MD5 32b268f7114cd6816d3b1c0558e88f95
SHA1 1d0caf4582173eb45e0be05134ed432a21f5af55
SHA512 9b453ea4ac1ec6f216629ca16654e78f02fb61af8158eb3153e3fbecaae8e78b50c53242c4e76a93d59f3f3150392805a18892b103cd689d6814c7984b5e866b
SSDEEP 768:d8w6iBGb+IyfJoTOBPca/CCNNl1uHBNdXIBMEB44w7Fv6NDzSkzNT2L:PIyfiTOpZNiMMuw7Z6NDzPNTI
TLSH
T18363E735C9A9B13FD3199C78DE060D84DF62BC8A4784BF97A7D11CE60F92A902F1D681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6096-0-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6096-22-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6096-23-0x0000000140000000-0x000000014013E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads