darksiderat | 7b5099a2989a1e7d52ac7a1c653b5dfb22f2c33ca01a00d20cd48276fc992f76

Analysis

user interaction
yes
max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EAX Console.exe
Size 102KB
Sample260809-cpp1dsycpe
SHA256 7b5099a2989a1e7d52ac7a1c653b5dfb22f2c33ca01a00d20cd48276fc992f76
MD5 4ff8e9553cd105851a7b58ac3729a5e8
SHA1 b171ff8f4913366891c3222afadb34e040392a68
SHA512 8d0eafeb32230bedbe160116e4196cbe2c8d652cea15bfe2820af06390065f544927b7c0a9721ccf259e8c35b116d40aea12a78d0c5ee9668253b16b1c4fa112
SSDEEP 1536:kYvxrhs3z5F8JPDCkRNLT8vJDxXjmJe37AG8Du6+WSss/eYwp:kAxNssh9RhiJIE3UY6+WSvm
TLSH
T1BDA33A06F75354E8C51EF1F445E6E673AA32BC1540309B6A16F0FA323E70A53EE69A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution darksiderat persistence trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/1524-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1524-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/5716-35-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3600	powershell.exe
5636	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2052	EAX Console.exe
5716	EAX Console.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 2 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
2496	cmd.exe
5568	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\EAX Console = "C:\\Users\\Admin\\AppData\\Roaming\\EAX Console.exe"	EAX Console.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\EAX Console = "C:\\Users\\Admin\\AppData\\Roaming\\EAX Console.exe"	EAX Console.exe

Checks system information in the registry 2 TTPs 4 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	EAX Console.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	EAX Console.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	EAX Console.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	EAX Console.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2560 set thread context of 1524	2560	EAX Console.exe	88
PID 2052 set thread context of 5716	2052	EAX Console.exe	100

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2496	cmd.exe
5568	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5224	schtasks.exe
5980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3600	powershell.exe
3600	powershell.exe
5636	powershell.exe
5636	powershell.exe
5636	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeIncreaseQuotaPrivilege	3600	powershell.exe
Token: SeSecurityPrivilege	3600	powershell.exe
Token: SeTakeOwnershipPrivilege	3600	powershell.exe
Token: SeLoadDriverPrivilege	3600	powershell.exe
Token: SeSystemProfilePrivilege	3600	powershell.exe
Token: SeSystemtimePrivilege	3600	powershell.exe
Token: SeProfSingleProcessPrivilege	3600	powershell.exe
Token: SeIncBasePriorityPrivilege	3600	powershell.exe
Token: SeCreatePagefilePrivilege	3600	powershell.exe
Token: SeBackupPrivilege	3600	powershell.exe
Token: SeRestorePrivilege	3600	powershell.exe
Token: SeShutdownPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeSystemEnvironmentPrivilege	3600	powershell.exe
Token: SeRemoteShutdownPrivilege	3600	powershell.exe
Token: SeUndockPrivilege	3600	powershell.exe
Token: SeManageVolumePrivilege	3600	powershell.exe
Token: 33	3600	powershell.exe
Token: 34	3600	powershell.exe
Token: 35	3600	powershell.exe
Token: 36	3600	powershell.exe
Token: SeIncreaseQuotaPrivilege	3600	powershell.exe
Token: SeSecurityPrivilege	3600	powershell.exe
Token: SeTakeOwnershipPrivilege	3600	powershell.exe
Token: SeLoadDriverPrivilege	3600	powershell.exe
Token: SeSystemProfilePrivilege	3600	powershell.exe
Token: SeSystemtimePrivilege	3600	powershell.exe
Token: SeProfSingleProcessPrivilege	3600	powershell.exe
Token: SeIncBasePriorityPrivilege	3600	powershell.exe
Token: SeCreatePagefilePrivilege	3600	powershell.exe
Token: SeBackupPrivilege	3600	powershell.exe
Token: SeRestorePrivilege	3600	powershell.exe
Token: SeShutdownPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeSystemEnvironmentPrivilege	3600	powershell.exe
Token: SeRemoteShutdownPrivilege	3600	powershell.exe
Token: SeUndockPrivilege	3600	powershell.exe
Token: SeManageVolumePrivilege	3600	powershell.exe
Token: 33	3600	powershell.exe
Token: 34	3600	powershell.exe
Token: 35	3600	powershell.exe
Token: 36	3600	powershell.exe
Token: SeDebugPrivilege	5636	powershell.exe
Token: SeIncreaseQuotaPrivilege	5636	powershell.exe
Token: SeSecurityPrivilege	5636	powershell.exe
Token: SeTakeOwnershipPrivilege	5636	powershell.exe
Token: SeLoadDriverPrivilege	5636	powershell.exe
Token: SeSystemProfilePrivilege	5636	powershell.exe
Token: SeSystemtimePrivilege	5636	powershell.exe
Token: SeProfSingleProcessPrivilege	5636	powershell.exe
Token: SeIncBasePriorityPrivilege	5636	powershell.exe
Token: SeCreatePagefilePrivilege	5636	powershell.exe
Token: SeBackupPrivilege	5636	powershell.exe
Token: SeRestorePrivilege	5636	powershell.exe
Token: SeShutdownPrivilege	5636	powershell.exe
Token: SeDebugPrivilege	5636	powershell.exe
Token: SeSystemEnvironmentPrivilege	5636	powershell.exe
Token: SeRemoteShutdownPrivilege	5636	powershell.exe
Token: SeUndockPrivilege	5636	powershell.exe
Token: SeManageVolumePrivilege	5636	powershell.exe
Token: 33	5636	powershell.exe
Token: 34	5636	powershell.exe
Token: 35	5636	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 1524	2560	EAX Console.exe	88
PID 2560 wrote to memory of 1524	2560	EAX Console.exe	88
PID 2560 wrote to memory of 1524	2560	EAX Console.exe	88
PID 2560 wrote to memory of 1524	2560	EAX Console.exe	88
PID 2560 wrote to memory of 1524	2560	EAX Console.exe	88
PID 2560 wrote to memory of 1524	2560	EAX Console.exe	88
PID 2560 wrote to memory of 1524	2560	EAX Console.exe	88
PID 2560 wrote to memory of 2496	2560	EAX Console.exe	90
PID 2496 wrote to memory of 3308	2496	cmd.exe	92
PID 2496 wrote to memory of 3600	2496	cmd.exe	93
PID 2560 wrote to memory of 5224	2560	EAX Console.exe	95
PID 2052 wrote to memory of 5716	2052	EAX Console.exe	100
PID 2052 wrote to memory of 5716	2052	EAX Console.exe	100
PID 2052 wrote to memory of 5716	2052	EAX Console.exe	100
PID 2052 wrote to memory of 5716	2052	EAX Console.exe	100
PID 2052 wrote to memory of 5716	2052	EAX Console.exe	100
PID 2052 wrote to memory of 5716	2052	EAX Console.exe	100
PID 2052 wrote to memory of 5716	2052	EAX Console.exe	100
PID 2052 wrote to memory of 5568	2052	EAX Console.exe	101
PID 5568 wrote to memory of 6124	5568	cmd.exe	103
PID 5568 wrote to memory of 5636	5568	cmd.exe	104
PID 2052 wrote to memory of 5980	2052	EAX Console.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\EAX Console.exe
"C:\Users\Admin\AppData\Local\Temp\EAX Console.exe"
1⤵
- Adds Run key to start application
- Checks system information in the registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\EAX Console.exe
  "C:\Users\Admin\AppData\Local\Temp\EAX Console.exe"
  2⤵
  PID:1524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3600
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "EAX Console" /tr "C:\Users\Admin\AppData\Roaming\EAX Console.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5224

C:\Users\Admin\AppData\Roaming\EAX Console.exe
"C:\Users\Admin\AppData\Roaming\EAX Console.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks system information in the registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Roaming\EAX Console.exe
  "C:\Users\Admin\AppData\Roaming\EAX Console.exe"
  2⤵
  - Executes dropped EXE
  PID:5716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:6124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5636
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "EAX Console" /tr "C:\Users\Admin\AppData\Roaming\EAX Console.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ae38cbf100a1dd03ef1873d1d742b83ebabf8f430a6caa239b0a8678d1236cd4
MD5 c7cc0af3ee0d232db9610874024e1b79
SHA1 651e741ac202240bde780de0392180e86f232f8c
SHA512 25b5d56f6063774fbc31c819bd39b6644f67072b3fd7da9e291346d990ada32e1efe6a6278d3099ef7e6340f0d9fc277d6e82b91b7f7f1a15310448d6de7179e
TLSH
T133216A33F3CC8615CC99013A50CDAC1036BAC7DB90DEDF976B84E555A53F699CE50150
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_d2dyzvqj.fzp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d2dyzvqj.fzp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

~msnDEV-b29842a9e1f9623c.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-b29842a9e1f9623c.tmp
Size 4B
SHA256 f4655d86259e078f8fcd27d2c9da5af6cff89c68b655e861aa523730bf7b05e7
MD5 44f6974781f7d0dd2d0a92384b1d7f15
SHA1 ae8444de02705346dae4f4c67d0c710b833c14e1
SHA512 10fb5968a67bf4e0623c90dbfe1e22060fc348d973f37b5ee8d8ea9c46e14886bf0edad49a85b59f747c80284e26b6f09cd4d6efaaf168dcb5048cf58380e0b9
MD5 SHA1 SHA512

Submit Download

EAX Console.exe

Path C:\Users\Admin\AppData\Roaming\EAX Console.exe
Size 102KB
SHA256 7b5099a2989a1e7d52ac7a1c653b5dfb22f2c33ca01a00d20cd48276fc992f76
MD5 4ff8e9553cd105851a7b58ac3729a5e8
SHA1 b171ff8f4913366891c3222afadb34e040392a68
SHA512 8d0eafeb32230bedbe160116e4196cbe2c8d652cea15bfe2820af06390065f544927b7c0a9721ccf259e8c35b116d40aea12a78d0c5ee9668253b16b1c4fa112
SSDEEP 1536:kYvxrhs3z5F8JPDCkRNLT8vJDxXjmJe37AG8Du6+WSss/eYwp:kAxNssh9RhiJIE3UY6+WSvm
TLSH
T1BDA33A06F75354E8C51EF1F445E6E673AA32BC1540309B6A16F0FA323E70A53EE69A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1524-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1524-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2052-55-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/2052-44-0x0000000285D10000-0x0000000285D6A000-memory.dmp

Download

memory/2560-30-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/2560-36-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/2560-0-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/3600-11-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-27-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-16-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-17-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-18-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-19-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-20-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-23-0x000002CC5D130000-0x000002CC5D14E000-memory.dmp

Download

memory/3600-25-0x000002CC5D380000-0x000002CC5D432000-memory.dmp

Download

memory/3600-24-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-26-0x000002CC5D150000-0x000002CC5D15A000-memory.dmp

Download

memory/3600-15-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-29-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-14-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-13-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-12-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-10-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-4-0x00007FFBDB51F000-0x00007FFBDB520000-memory.dmp

Download

memory/3600-9-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/3600-8-0x000002CC5D080000-0x000002CC5D0A2000-memory.dmp

Download

memory/3600-5-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/5716-35-0x0000000140000000-0x0000000140015000-memory.dmp

Download