darksiderat | 75b5993514badd95ae8cdf50359358186f8dd02ac42b20836872838845794e87

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vgc_sniffer.exe
Size 2.9MB
Sample260905-drl7ysswft
SHA256 75b5993514badd95ae8cdf50359358186f8dd02ac42b20836872838845794e87
MD5 69d09c2c6e6940c5eac01eca3530b552
SHA1 6cdd1f90de5e56f2ce9eb435bf7b9924a36011f2
SHA512 291c344a35147224730b28ddb08c54e27ce1f49f84f4e0584c3407b23bb425543aad5dba7e953a384bb2bbbb090ec21360e940d06f0780191f0d74db393c0fa9
SSDEEP 49152:dN0eMcQkBglSXiAkNU0mbjQtd48mU305hz0qR9jtX0fn:nNQkBglSXi/UMtd4s05hz0qR9jtgn
TLSH
T1B9E5E74369DB0DE9DED677B861C322399734FC71CA2D1E3EA608C23159636C4A92EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/1444-0-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1444-6-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/files/0x000d00000001c4f6-37.dat	family_darksiderat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	3308	vgc_sniffer.exe

Executes dropped EXE 1 IoCs

pid	Process
2568	ox_1788578080905.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3308 set thread context of 1444	3308	vgc_sniffer.exe	90

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1444	3308	vgc_sniffer.exe	90
PID 3308 wrote to memory of 1444	3308	vgc_sniffer.exe	90
PID 3308 wrote to memory of 1444	3308	vgc_sniffer.exe	90
PID 3308 wrote to memory of 1444	3308	vgc_sniffer.exe	90
PID 3308 wrote to memory of 1444	3308	vgc_sniffer.exe	90
PID 3308 wrote to memory of 1444	3308	vgc_sniffer.exe	90
PID 3308 wrote to memory of 1444	3308	vgc_sniffer.exe	90
PID 3308 wrote to memory of 4172	3308	vgc_sniffer.exe	91
PID 4172 wrote to memory of 2568	4172	cmd.exe	93
PID 2568 wrote to memory of 3584	2568	ox_1788578080905.exe	95
PID 2568 wrote to memory of 3584	2568	ox_1788578080905.exe	95
PID 2568 wrote to memory of 3584	2568	ox_1788578080905.exe	95
PID 2568 wrote to memory of 3584	2568	ox_1788578080905.exe	95
PID 2568 wrote to memory of 3584	2568	ox_1788578080905.exe	95
PID 2568 wrote to memory of 3584	2568	ox_1788578080905.exe	95
PID 2568 wrote to memory of 3584	2568	ox_1788578080905.exe	95
PID 2568 wrote to memory of 3584	2568	ox_1788578080905.exe	95
PID 2568 wrote to memory of 3584	2568	ox_1788578080905.exe	95

C:\Users\Admin\AppData\Local\Temp\vgc_sniffer.exe
"C:\Users\Admin\AppData\Local\Temp\vgc_sniffer.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\vgc_sniffer.exe
  "C:\Users\Admin\AppData\Local\Temp\vgc_sniffer.exe"
  2⤵
  PID:1444
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1788578080905.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Users\Admin\AppData\Local\Temp\ox_1788578080905.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1788578080905.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\System32\licensingdiag.exe
      "C:\Windows\System32\licensingdiag.exe"
      4⤵
      PID:3584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

config.ini

Path C:\Users\Admin\AppData\Local\Temp\config.ini
Size 252B
SHA256 483c6a854b2d84fab2eecf393c74734d2a26f3baec1fc870b507c5e5a6d12ead
MD5 71ce8b8c60e955cc24295324bde71652
SHA1 6c3305cfb73cfda460c0785bde2e4e1b8593e05a
SHA512 c3e8183b14c389b5f1ad98459614817c57fd9f97090d9d379727e5e5447890ba0bfd48d5e16171fb555a94753f2031f110472b558a371435c564b5a00186810b
TLSH
T12CD09795930248A836EC3CBC8807540100FFEC2B7D128920ABAC3A404F8493D7A7C072
MD5 SHA1 SHA512 TLSH

Submit Download

ox_1788578080905.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1788578080905.exe
Size 56KB
SHA256 999ec76c0eb8fdeebd7d9583eed68c4acf7b983e6d08e086a9bf6f6d81e0f1bd
MD5 e950167b7fb0845be10113967d330d26
SHA1 f6d9c02971073396fd615bb95209f45c022fdebd
SHA512 c89191d2f8c90b7d4c43616b1ec9bd5040953c3042f78b9ad13f96fbe4e6cb433d10cae2c729da29fcee96878a11c7cd17055998c1cf1e1c215328c43a9dbafb
SSDEEP 768:7b8CDi1y33B6H78VNAfRQvpJcOMhcKPPzEOWp54vg5d5YP98yxA1XbXNMkW7rCV0:XD6H78vcjHWp0g5rBSmhJW7rCVoekP
TLSH
T15C430935EA5EB06FD359C834DD470D06CE12BCCA9AA4BB9B57910CD20DEAF609B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1444-0-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1444-6-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3308-56-0x0000000140000000-0x00000001402F8000-memory.dmp

Download

memory/3584-85-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-97-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-78-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-83-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-84-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-72-0x000001DFC2C90000-0x000001DFC2C91000-memory.dmp

Download

memory/3584-89-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-93-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-96-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-71-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-95-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-94-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-92-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-91-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-90-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-87-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-86-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

memory/3584-88-0x000001DFC2570000-0x000001DFC2C89000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads