Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 16:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mfa bypass.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
mfa bypass.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target mfa bypass.exe
- Size 1.2MB
- Sample260910-tmng8adq41
- SHA256 8b0bdc48f9b6f16861253516459a0229fdc785bf7609a99483d177abe1fb891f
- MD5 f24e32c2017e7ba09d4ca8aeebada5f6
- SHA1 f06017fa63e7d48908e97a045c942d0b613334d7
- SHA512 7f0fc288d8673e775deeb5d4cd14202a8893d4d0318a2ae43cc761418935454c9f006366c671a690ab4024fb6829e7e4df4b97c87266678e2a12a1bb281b21ce
- SSDEEP 12288:li8gTcZTXnbsqO0vzmEl3O0vzmElFO0vzmEleO0vzmElPO0vzmEliO0vzmEl:TnbsqFzz3FzzFFzzeFzzPFzziFzz
- TLSH T18E45D006EF97059DE0BFC4B9D9A664B7E2B1740E43D0DDDB2A8096730E729A06B3DD10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 7 IoCs
resource yara_rule behavioral2/memory/2032-23-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/5820-21-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/2576-14-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/2420-11-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/3244-9-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/5820-2-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/616-18-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat - Suspicious use of SetThreadContext 12 IoCs
description pid Process procid_target PID 6028 set thread context of 3452 6028 mfa bypass.exe 91 PID 6028 set thread context of 5820 6028 mfa bypass.exe 92 PID 6028 set thread context of 4900 6028 mfa bypass.exe 93 PID 6028 set thread context of 2032 6028 mfa bypass.exe 94 PID 6028 set thread context of 4792 6028 mfa bypass.exe 95 PID 6028 set thread context of 2420 6028 mfa bypass.exe 96 PID 6028 set thread context of 3244 6028 mfa bypass.exe 97 PID 6028 set thread context of 1984 6028 mfa bypass.exe 98 PID 6028 set thread context of 2936 6028 mfa bypass.exe 100 PID 6028 set thread context of 2576 6028 mfa bypass.exe 99 PID 6028 set thread context of 616 6028 mfa bypass.exe 90 PID 6028 set thread context of 3412 6028 mfa bypass.exe 101 - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6028 wrote to memory of 3452 6028 mfa bypass.exe 91 PID 6028 wrote to memory of 3452 6028 mfa bypass.exe 91 PID 6028 wrote to memory of 3452 6028 mfa bypass.exe 91 PID 6028 wrote to memory of 3452 6028 mfa bypass.exe 91 PID 6028 wrote to memory of 3452 6028 mfa bypass.exe 91 PID 6028 wrote to memory of 3452 6028 mfa bypass.exe 91 PID 6028 wrote to memory of 3452 6028 mfa bypass.exe 91 PID 6028 wrote to memory of 5820 6028 mfa bypass.exe 92 PID 6028 wrote to memory of 5820 6028 mfa bypass.exe 92 PID 6028 wrote to memory of 5820 6028 mfa bypass.exe 92 PID 6028 wrote to memory of 5820 6028 mfa bypass.exe 92 PID 6028 wrote to memory of 5820 6028 mfa bypass.exe 92 PID 6028 wrote to memory of 5820 6028 mfa bypass.exe 92 PID 6028 wrote to memory of 5820 6028 mfa bypass.exe 92 PID 6028 wrote to memory of 4900 6028 mfa bypass.exe 93 PID 6028 wrote to memory of 4900 6028 mfa bypass.exe 93 PID 6028 wrote to memory of 4900 6028 mfa bypass.exe 93 PID 6028 wrote to memory of 4900 6028 mfa bypass.exe 93 PID 6028 wrote to memory of 4900 6028 mfa bypass.exe 93 PID 6028 wrote to memory of 4900 6028 mfa bypass.exe 93 PID 6028 wrote to memory of 4900 6028 mfa bypass.exe 93 PID 6028 wrote to memory of 2032 6028 mfa bypass.exe 94 PID 6028 wrote to memory of 2032 6028 mfa bypass.exe 94 PID 6028 wrote to memory of 2032 6028 mfa bypass.exe 94 PID 6028 wrote to memory of 2032 6028 mfa bypass.exe 94 PID 6028 wrote to memory of 2032 6028 mfa bypass.exe 94 PID 6028 wrote to memory of 2032 6028 mfa bypass.exe 94 PID 6028 wrote to memory of 2032 6028 mfa bypass.exe 94 PID 6028 wrote to memory of 4792 6028 mfa bypass.exe 95 PID 6028 wrote to memory of 4792 6028 mfa bypass.exe 95 PID 6028 wrote to memory of 4792 6028 mfa bypass.exe 95 PID 6028 wrote to memory of 4792 6028 mfa bypass.exe 95 PID 6028 wrote to memory of 4792 6028 mfa bypass.exe 95 PID 6028 wrote to memory of 4792 6028 mfa bypass.exe 95 PID 6028 wrote to memory of 4792 6028 mfa bypass.exe 95 PID 6028 wrote to memory of 2420 6028 mfa bypass.exe 96 PID 6028 wrote to memory of 2420 6028 mfa bypass.exe 96 PID 6028 wrote to memory of 2420 6028 mfa bypass.exe 96 PID 6028 wrote to memory of 2420 6028 mfa bypass.exe 96 PID 6028 wrote to memory of 2420 6028 mfa bypass.exe 96 PID 6028 wrote to memory of 2420 6028 mfa bypass.exe 96 PID 6028 wrote to memory of 2420 6028 mfa bypass.exe 96 PID 6028 wrote to memory of 3244 6028 mfa bypass.exe 97 PID 6028 wrote to memory of 1984 6028 mfa bypass.exe 98 PID 6028 wrote to memory of 3244 6028 mfa bypass.exe 97 PID 6028 wrote to memory of 3244 6028 mfa bypass.exe 97 PID 6028 wrote to memory of 1984 6028 mfa bypass.exe 98 PID 6028 wrote to memory of 3244 6028 mfa bypass.exe 97 PID 6028 wrote to memory of 1984 6028 mfa bypass.exe 98 PID 6028 wrote to memory of 3244 6028 mfa bypass.exe 97 PID 6028 wrote to memory of 3244 6028 mfa bypass.exe 97 PID 6028 wrote to memory of 3244 6028 mfa bypass.exe 97 PID 6028 wrote to memory of 1984 6028 mfa bypass.exe 98 PID 6028 wrote to memory of 1984 6028 mfa bypass.exe 98 PID 6028 wrote to memory of 1984 6028 mfa bypass.exe 98 PID 6028 wrote to memory of 1984 6028 mfa bypass.exe 98 PID 6028 wrote to memory of 2576 6028 mfa bypass.exe 99 PID 6028 wrote to memory of 2936 6028 mfa bypass.exe 100 PID 6028 wrote to memory of 2576 6028 mfa bypass.exe 99 PID 6028 wrote to memory of 2576 6028 mfa bypass.exe 99 PID 6028 wrote to memory of 2576 6028 mfa bypass.exe 99 PID 6028 wrote to memory of 2576 6028 mfa bypass.exe 99 PID 6028 wrote to memory of 2936 6028 mfa bypass.exe 100 PID 6028 wrote to memory of 2576 6028 mfa bypass.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"2⤵PID:616
-
-
C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"2⤵PID:3452
-
-
C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"2⤵PID:5820
-
-
C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"2⤵PID:4900
-
-
C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"2⤵PID:2032
-
-
C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"2⤵PID:4792
-
-
C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"2⤵PID:2420
-
-
C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"2⤵PID:3244
-
-
C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"2⤵PID:1984
-
-
C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"2⤵PID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"2⤵PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"C:\Users\Admin\AppData\Local\Temp\mfa bypass.exe"2⤵PID:3412
-