darksiderat | 083b788f86f7d6d4da69257354f22c86d06093fff29ecf0b45d140ed25ed0b08

Analysis

user interaction
yes
max time kernel
298s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
coldperm cracked.exe
Size 3.5MB
Sample260811-m149kaea49
SHA256 083b788f86f7d6d4da69257354f22c86d06093fff29ecf0b45d140ed25ed0b08
MD5 e4e4a8043f15db7b21de7887014089dc
SHA1 a187aeac481f9234b2cbfcbaebc41da7a4677fa1
SHA512 124ca2852185ccf5ef45e54fbd8a2d568aded54e01c6e2a8ebd71080816123c325d4ffed50d876a819614d2825e5bd6fdd3a67a25e7064cba02e5116e0d00bfd
SSDEEP 49152:8hyMqPgRBl6IB/0KLkvEfZu4uCqsu7J4bVp4cjACdiQL2KhdpXJM34/7XpyYNSyw:FY5CEfZu4uCqsu7J4REEzZM3QpyY
TLSH
T19D06CF2AF7A441E9C47B913CC8A6A707F3B178581731D7DB22E859581F63BE05A3E780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4d9-29.dat	family_darksiderat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	5576	coldperm cracked.exe

Executes dropped EXE 1 IoCs

pid	Process
3492	ox_1786445823517.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4396	powershell.exe
4724	powershell.exe
2728	powershell.exe
2644	powershell.exe
5208	powershell.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1336	cmd.exe
3924	cmd.exe
2616	cmd.exe
4864	cmd.exe
5640	cmd.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4396	powershell.exe
4396	powershell.exe
4396	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
2728	powershell.exe
2728	powershell.exe
2728	powershell.exe
2644	powershell.exe
2644	powershell.exe
2644	powershell.exe
5208	powershell.exe
5208	powershell.exe
5208	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5576	coldperm cracked.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeIncreaseQuotaPrivilege	4396	powershell.exe
Token: SeSecurityPrivilege	4396	powershell.exe
Token: SeTakeOwnershipPrivilege	4396	powershell.exe
Token: SeLoadDriverPrivilege	4396	powershell.exe
Token: SeSystemProfilePrivilege	4396	powershell.exe
Token: SeSystemtimePrivilege	4396	powershell.exe
Token: SeProfSingleProcessPrivilege	4396	powershell.exe
Token: SeIncBasePriorityPrivilege	4396	powershell.exe
Token: SeCreatePagefilePrivilege	4396	powershell.exe
Token: SeBackupPrivilege	4396	powershell.exe
Token: SeRestorePrivilege	4396	powershell.exe
Token: SeShutdownPrivilege	4396	powershell.exe
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeSystemEnvironmentPrivilege	4396	powershell.exe
Token: SeRemoteShutdownPrivilege	4396	powershell.exe
Token: SeUndockPrivilege	4396	powershell.exe
Token: SeManageVolumePrivilege	4396	powershell.exe
Token: 33	4396	powershell.exe
Token: 34	4396	powershell.exe
Token: 35	4396	powershell.exe
Token: 36	4396	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeIncreaseQuotaPrivilege	4724	powershell.exe
Token: SeSecurityPrivilege	4724	powershell.exe
Token: SeTakeOwnershipPrivilege	4724	powershell.exe
Token: SeLoadDriverPrivilege	4724	powershell.exe
Token: SeSystemProfilePrivilege	4724	powershell.exe
Token: SeSystemtimePrivilege	4724	powershell.exe
Token: SeProfSingleProcessPrivilege	4724	powershell.exe
Token: SeIncBasePriorityPrivilege	4724	powershell.exe
Token: SeCreatePagefilePrivilege	4724	powershell.exe
Token: SeBackupPrivilege	4724	powershell.exe
Token: SeRestorePrivilege	4724	powershell.exe
Token: SeShutdownPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeSystemEnvironmentPrivilege	4724	powershell.exe
Token: SeRemoteShutdownPrivilege	4724	powershell.exe
Token: SeUndockPrivilege	4724	powershell.exe
Token: SeManageVolumePrivilege	4724	powershell.exe
Token: 33	4724	powershell.exe
Token: 34	4724	powershell.exe
Token: 35	4724	powershell.exe
Token: 36	4724	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeIncreaseQuotaPrivilege	2728	powershell.exe
Token: SeSecurityPrivilege	2728	powershell.exe
Token: SeTakeOwnershipPrivilege	2728	powershell.exe
Token: SeLoadDriverPrivilege	2728	powershell.exe
Token: SeSystemProfilePrivilege	2728	powershell.exe
Token: SeSystemtimePrivilege	2728	powershell.exe
Token: SeProfSingleProcessPrivilege	2728	powershell.exe
Token: SeIncBasePriorityPrivilege	2728	powershell.exe
Token: SeCreatePagefilePrivilege	2728	powershell.exe
Token: SeBackupPrivilege	2728	powershell.exe
Token: SeRestorePrivilege	2728	powershell.exe
Token: SeShutdownPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeSystemEnvironmentPrivilege	2728	powershell.exe
Token: SeRemoteShutdownPrivilege	2728	powershell.exe
Token: SeUndockPrivilege	2728	powershell.exe
Token: SeManageVolumePrivilege	2728	powershell.exe
Token: 33	2728	powershell.exe
Token: 34	2728	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5576	coldperm cracked.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5576 wrote to memory of 2616	5576	coldperm cracked.exe	90
PID 2616 wrote to memory of 4396	2616	cmd.exe	92
PID 5576 wrote to memory of 5596	5576	coldperm cracked.exe	93
PID 5596 wrote to memory of 3492	5596	cmd.exe	95
PID 5576 wrote to memory of 4864	5576	coldperm cracked.exe	99
PID 4864 wrote to memory of 4724	4864	cmd.exe	101
PID 5576 wrote to memory of 5640	5576	coldperm cracked.exe	102
PID 5640 wrote to memory of 2728	5640	cmd.exe	104
PID 5576 wrote to memory of 1336	5576	coldperm cracked.exe	105
PID 1336 wrote to memory of 2644	1336	cmd.exe	107
PID 5576 wrote to memory of 3924	5576	coldperm cracked.exe	108
PID 3924 wrote to memory of 5208	3924	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\coldperm cracked.exe
"C:\Users\Admin\AppData\Local\Temp\coldperm cracked.exe"
1⤵
- Downloads MZ/PE file
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1786445823517.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5596
- - C:\Users\Admin\AppData\Local\Temp\ox_1786445823517.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1786445823517.exe
    3⤵
    - Executes dropped EXE
    PID:3492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).Model"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 545804662875039d9ea177eba00f0878173a24490cc6b4759f91fac066fe0329
MD5 e9147a8d19a7d98b0e36dfea9922cac2
SHA1 f9ad1880fa49e9155fad199ccf5f8762e07f0ef1
SHA512 342e602f26f8abf3fdd30fcfc36ee9000f11b47858b98d1c2806738bdfb765343fc8cd179bd5bc10e8c9661b9ec4d9b5bdae6aa84ec225f4903ccc9b5464a8d0
TLSH
T135217633B3DC8214C899013A10DDAC1036B687CB40DECF9B6B85E159A42F299DF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 77cfb95d3b72d676b04cbcf41f7b67612064be9394a11778b4ee3aab89b4e6fb
MD5 7f167f623d3c4d0cc401b05f18db3a82
SHA1 50cfb498e3c693789d02ebe366a1f24f01d6883d
SHA512 00f73118e77a8491b49b5c2c41cd83fbd5b3440b43f8de2eba50a6d60640bceffa5072ee805bb22a3c070d530c6af5a0ab8f26d680333613b38d47cf57c77273
TLSH
T17B219833F3DC8224DC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e441c816a4a6152af3a38287b4b617bdeae1cead3e909365a790a4192649849f
MD5 ea721e0a01c59316d28537bd71cdbea3
SHA1 3a89c7081b26f6e02688e899836236d19d53e351
SHA512 fee2bc5404f3211e55e53f03be06a8bc237752d63939f48e78ccdd73fdac5b9243d30157647252b96aec9945079358037281b7fd2e8fd70826042f1dcb3a4957
TLSH
T19C219837F3DC8214DCA9003A10DDAD0036B6CBCB40DECF5B6B81E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0de40fcbe3a4fde217d883e36d6b6038203b2e483fd5063078c1fdfcb780a1d0
MD5 5632f566323bc90e18293a3897f3f6ec
SHA1 d3fd1a7f830579298cdd7c216d43b75d65082bc6
SHA512 8beba7bc0e60558663048451a0d97ae7bc8f41d1b847447586170d2abfcf592a620be74a601634a80274857fcd314b62e6bb094454e686251c7636d41af5bbdb
TLSH
T184219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B81E259A82F298DF60060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bf4nnbuu.1ia.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bf4nnbuu.1ia.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ox_1786445823517.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1786445823517.exe
Size 67KB
SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
MD5 32b268f7114cd6816d3b1c0558e88f95
SHA1 1d0caf4582173eb45e0be05134ed432a21f5af55
SHA512 9b453ea4ac1ec6f216629ca16654e78f02fb61af8158eb3153e3fbecaae8e78b50c53242c4e76a93d59f3f3150392805a18892b103cd689d6814c7984b5e866b
SSDEEP 768:d8w6iBGb+IyfJoTOBPca/CCNNl1uHBNdXIBMEB44w7Fv6NDzSkzNT2L:PIyfiTOpZNiMMuw7Z6NDzPNTI
TLSH
T18363E735C9A9B13FD3199C78DE060D84DF62BC8A4784BF97A7D11CE60F92A902F1D681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4396-27-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/4396-41-0x000001F1F50F0000-0x000001F1F50FA000-memory.dmp

Download

memory/4396-26-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/4396-31-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/4396-32-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/4396-33-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/4396-34-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/4396-35-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/4396-36-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/4396-40-0x000001F1F53B0000-0x000001F1F5462000-memory.dmp

Download

memory/4396-39-0x000001F1F50D0000-0x000001F1F50EE000-memory.dmp

Download

memory/4396-9-0x00007FFD605CF000-0x00007FFD605D0000-memory.dmp

Download

memory/4396-43-0x000001F1F5130000-0x000001F1F5154000-memory.dmp

Download

memory/4396-42-0x000001F1F5130000-0x000001F1F515A000-memory.dmp

Download

memory/4396-45-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/4396-25-0x000001F1F5030000-0x000001F1F5052000-memory.dmp

Download

memory/4396-22-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/4396-14-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/4396-13-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/5576-67-0x0000000140000000-0x000000014037E000-memory.dmp

Download

memory/5576-0-0x0000000140000000-0x000000014037E000-memory.dmp

Download

memory/5576-70-0x0000000140000000-0x000000014037E000-memory.dmp

Download