Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/07/2026, 00:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
valorantvgcq.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
valorantvgcq.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target valorantvgcq.exe
- Size 1.6MB
- Sample260710-axq7bacw21
- SHA256 d048e5dac736bb4c9b4c29f06c216c8798b2b8e576100912b83f07bd9da8aeb3
- MD5 544a4055b26f4fe54a41a7b6ecaf48fd
- SHA1 efb0e0a499f2399c0349cf87d8c2f2c0fe41d79e
- SHA512 1dbec0b9a9374187a279d9d484949c75924a3f8524ab3789d7d88f93af315e637c80578f987dcece804beda58785875e2f9e28e9e41b1c8312d99075efcffe0e
- SSDEEP 24576:mmv3ujNvpDkRuuTI2a61FxnYDywDqlOB/am6+bZ7RLhHB:ms4vDkRf+ywlamr9r
- TLSH T1EE757C07E3E5CAEAC89EE274528B2718E770FC5117916ADB936052502F577E89E3FB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 1 IoCs
resource yara_rule behavioral1/files/0x0007000000024231-20.dat family_darksiderat - Downloads MZ/PE file 1 IoCs
flow pid Process 4 5032 valorantvgcq.exe - Executes dropped EXE 1 IoCs
pid Process 4868 ox_1783643767685.exe - Stops running service(s) 4 TTPs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1900 sc.exe 3192 sc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe 5032 valorantvgcq.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5032 wrote to memory of 4620 5032 valorantvgcq.exe 86 PID 4620 wrote to memory of 1900 4620 cmd.exe 87 PID 5032 wrote to memory of 2092 5032 valorantvgcq.exe 88 PID 2092 wrote to memory of 3192 2092 cmd.exe 89 PID 5032 wrote to memory of 380 5032 valorantvgcq.exe 92 PID 380 wrote to memory of 4868 380 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\valorantvgcq.exe"C:\Users\Admin\AppData\Local\Temp\valorantvgcq.exe"1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\system32\sc.exesc stop vgc3⤵
- Launches sc.exe
PID:1900
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\system32\sc.exesc start vgc3⤵
- Launches sc.exe
PID:3192
-
-
-
C:\Windows\system32\cmd.exe/c start C:\Users\Admin\AppData\Local\Temp\ox_1783643767685.exe2⤵
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\ox_1783643767685.exeC:\Users\Admin\AppData\Local\Temp\ox_1783643767685.exe3⤵
- Executes dropped EXE
PID:4868
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ox_1783643767685.exe
- Size 67KB
- SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
- MD5 32b268f7114cd6816d3b1c0558e88f95
- SHA1 1d0caf4582173eb45e0be05134ed432a21f5af55
- SHA512 9b453ea4ac1ec6f216629ca16654e78f02fb61af8158eb3153e3fbecaae8e78b50c53242c4e76a93d59f3f3150392805a18892b103cd689d6814c7984b5e866b
- SSDEEP 768:d8w6iBGb+IyfJoTOBPca/CCNNl1uHBNdXIBMEB44w7Fv6NDzSkzNT2L:PIyfiTOpZNiMMuw7Z6NDzPNTI
- TLSH T18363E735C9A9B13FD3199C78DE060D84DF62BC8A4784BF97A7D11CE60F92A902F1D681
- MD5 SHA1 SHA512 SSDEEP TLSH