General
- Target Loader(1).exe
- Size 147KB
- Sample260810-v84xrshe97
- SHA256 2afba519dbb22357c1e9f3a8feca2b9131b79b3de9c0f02f921d2db49550cfc0
Score
10/10
Malware Config
Targets
-
- Target Loader(1).exe
- Size 147KB
- SHA256 2afba519dbb22357c1e9f3a8feca2b9131b79b3de9c0f02f921d2db49550cfc0
Score10/10-
Detects DarkSideRAT
-
Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
-
Modifies WinLogon for persistence
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Registers new Windows logon scripts automatically executed at logon.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1