darksiderat | 165cf1f57e675aa357574f1246d65980d7e9bb92be9f18fa9c9adfbcc2ab761a

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Risxn_Bloom_V2.exe
Size 1.6MB
Sample260908-lmcrqaef29
SHA256 165cf1f57e675aa357574f1246d65980d7e9bb92be9f18fa9c9adfbcc2ab761a
MD5 84c2ec888ea8609131bbfa433a27f395
SHA1 64878e0b9176280de1cb0ba6fdcda9147852f955
SHA512 a2ea552d2b63a50b5a403cd266dcfce1b011fc9649018ca3e4b20797a8b0edbb4ad436d3fc21cccb037edeb6126193d00037258d3d77bc5f73c7c6ba206da9e4
SSDEEP 49152:PVavLoTTA/aqztcrIEoul9WPAbJxOWwhLjPcuoc5kk:PVrTTA/XjEou6PAtxOWwh/cuz
TLSH
T150757B0323A2C0E9DE6791B6C525D632D6727C54073896DB15E0BE2FFFB3A911A3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c58c-17.dat	family_darksiderat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	3552	Risxn_Bloom_V2.exe

Executes dropped EXE 1 IoCs

pid	Process
2432	ox_1788860322483.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3552	Risxn_Bloom_V2.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 2704	3552	Risxn_Bloom_V2.exe	88
PID 2704 wrote to memory of 2432	2704	cmd.exe	90
PID 2432 wrote to memory of 3500	2432	ox_1788860322483.exe	92
PID 2432 wrote to memory of 3500	2432	ox_1788860322483.exe	92
PID 2432 wrote to memory of 3500	2432	ox_1788860322483.exe	92
PID 2432 wrote to memory of 3500	2432	ox_1788860322483.exe	92
PID 2432 wrote to memory of 3500	2432	ox_1788860322483.exe	92
PID 2432 wrote to memory of 3500	2432	ox_1788860322483.exe	92
PID 2432 wrote to memory of 3500	2432	ox_1788860322483.exe	92
PID 2432 wrote to memory of 3500	2432	ox_1788860322483.exe	92
PID 2432 wrote to memory of 3500	2432	ox_1788860322483.exe	92

C:\Users\Admin\AppData\Local\Temp\Risxn_Bloom_V2.exe
"C:\Users\Admin\AppData\Local\Temp\Risxn_Bloom_V2.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1788860322483.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Local\Temp\ox_1788860322483.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1788860322483.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\System32\ktmutil.exe
      "C:\Windows\System32\ktmutil.exe"
      4⤵
      PID:3500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ox_1788860322483.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1788860322483.exe
Size 56KB
SHA256 47c72580795661e45c4ea0dcc31954cc63467f149e013fb77a6816ad67ac2750
MD5 1dfcd6d0690c4eb10a99b19eb0fd05e9
SHA1 dd58e6af2871c70a4532fc7d7bd8a56f7f47966e
SHA512 ada4387e34541c59147672146f6189766855ab2edebbad0dbba83b85339b69dc3a08dfc6a2716f6460f3afc4c93607fbe5bb22739920374e4f37ce8c00a92836
SSDEEP 768:RUcqx3pSuSDFfQYqXKmEXNt+VtzOOWp54vg5d5YP98yxA1XbXy/kW7rCVr8Z0kP:6WuWbpb+tWp0g5rBSm2sW7rCVoekP
TLSH
T1CD43F834EA5EB06FD359D830DD430D16DD52BCCA97A0BB9B57910DD20EAAF209B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3500-46-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-40-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-24-0x0000015E84A00000-0x0000015E84A01000-memory.dmp

Download

memory/3500-23-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-30-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-45-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-48-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-49-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-39-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-43-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-41-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-42-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-44-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-47-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-38-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-37-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-36-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3500-35-0x0000015E842E0000-0x0000015E849F9000-memory.dmp

Download

memory/3552-19-0x0000000140000000-0x0000000140195000-memory.dmp

Download

memory/3552-0-0x0000000140000000-0x0000000140195000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads