darksiderat | e9c2488bf53abcae605ab5f6773495435e07e9498f7acf98fea9f492d59336bd

Analysis

user interaction
yes
max time kernel
6s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Emu (2).exe
Size 364KB
Sample260802-wmg2jsvsbt
SHA256 e9c2488bf53abcae605ab5f6773495435e07e9498f7acf98fea9f492d59336bd
MD5 4248f620083a30391ed3158b71106e74
SHA1 510fed92932f33a44f84c7a09ab8295f10763ce1
SHA512 aba535d07af8ec6b3319ab2914d109850e40b71bed150d07db0aef8f52f09489f8dabcca561933cf99d16146ff698aba95dbcf19488a9dd4c9b90dd00d83edba
SSDEEP 6144:SgFSeACHpm08WTUhhCQrD2OU+QR0nzJ80prRJoPLg9xMvic86El9:VHpmllh5D2in9XO0vzmEl
TLSH
T10284AE36DF5610ADD17ED4B8D9625453EF72744B03E0E9CB27805AB30E36AE4AB3DA10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 8 IoCs

resource	yara_rule
behavioral1/memory/4000-10-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4000-12-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4000-11-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5744-8-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5744-6-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5744-5-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5744-4-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4000-13-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3296 set thread context of 3380	3296	Emu (2).exe	82
PID 3296 set thread context of 5744	3296	Emu (2).exe	83
PID 3296 set thread context of 4000	3296	Emu (2).exe	84

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4500	sc.exe
3848	sc.exe
1136	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4048	cmd.exe
676	cmd.exe
8	cmd.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4048	3296	Emu (2).exe	81
PID 3296 wrote to memory of 3380	3296	Emu (2).exe	82
PID 3296 wrote to memory of 3380	3296	Emu (2).exe	82
PID 3296 wrote to memory of 3380	3296	Emu (2).exe	82
PID 3296 wrote to memory of 3380	3296	Emu (2).exe	82
PID 3296 wrote to memory of 3380	3296	Emu (2).exe	82
PID 3296 wrote to memory of 3380	3296	Emu (2).exe	82
PID 3296 wrote to memory of 3380	3296	Emu (2).exe	82
PID 3296 wrote to memory of 5744	3296	Emu (2).exe	83
PID 3296 wrote to memory of 5744	3296	Emu (2).exe	83
PID 3296 wrote to memory of 5744	3296	Emu (2).exe	83
PID 3296 wrote to memory of 5744	3296	Emu (2).exe	83
PID 3296 wrote to memory of 5744	3296	Emu (2).exe	83
PID 3296 wrote to memory of 5744	3296	Emu (2).exe	83
PID 3296 wrote to memory of 5744	3296	Emu (2).exe	83
PID 3296 wrote to memory of 4000	3296	Emu (2).exe	84
PID 3296 wrote to memory of 4000	3296	Emu (2).exe	84
PID 3296 wrote to memory of 4000	3296	Emu (2).exe	84
PID 3296 wrote to memory of 4000	3296	Emu (2).exe	84
PID 3296 wrote to memory of 4000	3296	Emu (2).exe	84
PID 3296 wrote to memory of 4000	3296	Emu (2).exe	84
PID 3296 wrote to memory of 4000	3296	Emu (2).exe	84
PID 4048 wrote to memory of 4500	4048	cmd.exe	86
PID 3296 wrote to memory of 676	3296	Emu (2).exe	93
PID 676 wrote to memory of 3848	676	cmd.exe	94
PID 3296 wrote to memory of 8	3296	Emu (2).exe	95
PID 8 wrote to memory of 1136	8	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\Emu (2).exe
"C:\Users\Admin\AppData\Local\Temp\Emu (2).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgk >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\system32\sc.exe
    sc start vgk
    3⤵
    - Launches sc.exe
    PID:4500
- C:\Users\Admin\AppData\Local\Temp\Emu (2).exe
  "C:\Users\Admin\AppData\Local\Temp\Emu (2).exe"
  2⤵
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\Emu (2).exe
  "C:\Users\Admin\AppData\Local\Temp\Emu (2).exe"
  2⤵
  PID:5744
- C:\Users\Admin\AppData\Local\Temp\Emu (2).exe
  "C:\Users\Admin\AppData\Local\Temp\Emu (2).exe"
  2⤵
  PID:4000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:3848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3296-0-0x0000000140000000-0x000000014006C000-memory.dmp

Download

memory/3380-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3380-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3380-3-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3380-7-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3380-16-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4000-10-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4000-12-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4000-11-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4000-13-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5744-8-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5744-4-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5744-5-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5744-6-0x0000000140000000-0x0000000140015000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads