darksiderat | bd407efc85bf3bd3bc33b8ae9464b8895db7d6a45747e066e820cb2d620394df

Analysis

user interaction
yes
max time kernel
58s
max time network
56s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
roxie.exe
Size 956KB
Sample260827-slapaswsft
SHA256 bd407efc85bf3bd3bc33b8ae9464b8895db7d6a45747e066e820cb2d620394df
MD5 9e436f64de415061f9657383e40d489a
SHA1 71d96c0599e093192ff0d1564db8968fbd211afb
SHA512 9e147b845d5212ca05d34001fc6a26f55457b703f99cd232f1e0c93e6783690531bfb8ba4e062e446ecb8961ca2306c1df8154356d0579d6a3e8730899f7aa48
SSDEEP 24576:KvZT0AivewuREIF2zIWZKMjMKJRhBMkayZww1R+gwy:KvZTQmwuREIF2zdoMjMK7L1Rd
TLSH
T113258D19AB5402F4D0B7D57CCE835413FB72784A43759AEB17D09A6A3F276E08A3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4960-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4960-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5672 set thread context of 4960	5672	roxie.exe	91

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3692	sc.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5516	cmd.exe
5528	cmd.exe
800	cmd.exe
3372	cmd.exe
3340	cmd.exe
4148	cmd.exe
5924	cmd.exe
3440	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3340	cmd.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
4660	taskkill.exe
2744	taskkill.exe
1480	taskkill.exe
1204	taskkill.exe
5536	taskkill.exe
5572	taskkill.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5672	roxie.exe
Token: SeDebugPrivilege	4660	taskkill.exe
Token: SeDebugPrivilege	2744	taskkill.exe
Token: SeDebugPrivilege	1480	taskkill.exe
Token: SeDebugPrivilege	1204	taskkill.exe
Token: SeDebugPrivilege	5536	taskkill.exe
Token: SeDebugPrivilege	5572	taskkill.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 3372	5672	roxie.exe	90
PID 5672 wrote to memory of 4960	5672	roxie.exe	91
PID 5672 wrote to memory of 4960	5672	roxie.exe	91
PID 5672 wrote to memory of 4960	5672	roxie.exe	91
PID 5672 wrote to memory of 4960	5672	roxie.exe	91
PID 5672 wrote to memory of 4960	5672	roxie.exe	91
PID 5672 wrote to memory of 4960	5672	roxie.exe	91
PID 5672 wrote to memory of 4960	5672	roxie.exe	91
PID 5672 wrote to memory of 3340	5672	roxie.exe	92
PID 3340 wrote to memory of 4660	3340	cmd.exe	93
PID 5672 wrote to memory of 4148	5672	roxie.exe	95
PID 4148 wrote to memory of 2744	4148	cmd.exe	96
PID 5672 wrote to memory of 5924	5672	roxie.exe	97
PID 5924 wrote to memory of 1480	5924	cmd.exe	98
PID 5672 wrote to memory of 3440	5672	roxie.exe	99
PID 3440 wrote to memory of 1204	3440	cmd.exe	100
PID 5672 wrote to memory of 5516	5672	roxie.exe	101
PID 5516 wrote to memory of 3692	5516	cmd.exe	102
PID 5672 wrote to memory of 5528	5672	roxie.exe	103
PID 5528 wrote to memory of 5536	5528	cmd.exe	104
PID 5672 wrote to memory of 800	5672	roxie.exe	105
PID 800 wrote to memory of 5572	800	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\roxie.exe
"C:\Users\Admin\AppData\Local\Temp\roxie.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title Roxie
  2⤵
  - Executes a command shell one-liner
  PID:3372
- C:\Users\Admin\AppData\Local\Temp\roxie.exe
  "C:\Users\Admin\AppData\Local\Temp\roxie.exe"
  2⤵
  PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM VALORANT-Win64-Shipping.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM VALORANT-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM RiotClientServices.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RiotClientServices.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM RiotClientUx.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5924
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RiotClientUx.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM RiotClientUxRender.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RiotClientUxRender.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5516
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:3692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM vgtray.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vgtray.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM vgc.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vgc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5572