darksiderat | 165cf1f57e675aa357574f1246d65980d7e9bb92be9f18fa9c9adfbcc2ab761a

Analysis

user interaction
yes
max time kernel
74s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Risxn_Bloom_V2.exe
Size 1.6MB
Sample260908-lmcrqaef29
SHA256 165cf1f57e675aa357574f1246d65980d7e9bb92be9f18fa9c9adfbcc2ab761a
MD5 84c2ec888ea8609131bbfa433a27f395
SHA1 64878e0b9176280de1cb0ba6fdcda9147852f955
SHA512 a2ea552d2b63a50b5a403cd266dcfce1b011fc9649018ca3e4b20797a8b0edbb4ad436d3fc21cccb037edeb6126193d00037258d3d77bc5f73c7c6ba206da9e4
SSDEEP 49152:PVavLoTTA/aqztcrIEoul9WPAbJxOWwhLjPcuoc5kk:PVrTTA/XjEou6PAtxOWwh/cuz
TLSH
T150757B0323A2C0E9DE6791B6C525D632D6727C54073896DB15E0BE2FFFB3A911A3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000002448f-15.dat	family_darksiderat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
42	3984	Risxn_Bloom_V2.exe

Executes dropped EXE 1 IoCs

pid	Process
2352	ox_1788860320392.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3984	Risxn_Bloom_V2.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 1964	3984	Risxn_Bloom_V2.exe	101
PID 1964 wrote to memory of 2352	1964	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\Risxn_Bloom_V2.exe
"C:\Users\Admin\AppData\Local\Temp\Risxn_Bloom_V2.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1788860320392.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Users\Admin\AppData\Local\Temp\ox_1788860320392.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1788860320392.exe
    3⤵
    - Executes dropped EXE
    PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ox_1788860320392.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1788860320392.exe
Size 56KB
SHA256 47c72580795661e45c4ea0dcc31954cc63467f149e013fb77a6816ad67ac2750
MD5 1dfcd6d0690c4eb10a99b19eb0fd05e9
SHA1 dd58e6af2871c70a4532fc7d7bd8a56f7f47966e
SHA512 ada4387e34541c59147672146f6189766855ab2edebbad0dbba83b85339b69dc3a08dfc6a2716f6460f3afc4c93607fbe5bb22739920374e4f37ce8c00a92836
SSDEEP 768:RUcqx3pSuSDFfQYqXKmEXNt+VtzOOWp54vg5d5YP98yxA1XbXy/kW7rCVr8Z0kP:6WuWbpb+tWp0g5rBSm2sW7rCVoekP
TLSH
T1CD43F834EA5EB06FD359D830DD430D16DD52BCCA97A0BB9B57910DD20EAAF209B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3984-0-0x0000000140000000-0x0000000140195000-memory.dmp

Download

memory/3984-3-0x0000000140000000-0x0000000140195000-memory.dmp

Download

memory/3984-17-0x0000000140000000-0x0000000140195000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads