Analysis
- user interaction
yes - max time kernel
56s - max time network
57s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 18:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
KIRA YAGAMI V2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
KIRA YAGAMI V2.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target KIRA YAGAMI V2.exe
- Size 649KB
- Sample260910-w5qfmswzfx
- SHA256 25b9c9b846aa3fdb29c5d9e6f02208b0ae784ec4b4966df5a823eee678e94c86
- MD5 1329da695ee278ad73b3a2c7ea1def5f
- SHA1 f7f166e9d8f55eebbe77a2d80d28f810be83d5db
- SHA512 390f7cad2dc77a5f4de7961f838c059ad798538f2bf1a558fdc5cf8a862c48f2a750dd70b11bec86fd787c7afc660b56fbe54b0e57429195d830bfc8bef22fe9
- SSDEEP 12288:SRRPoXsoQ2hsFZyc4jLgRWj52z38OHY4faN9g:SRRQ8oQ2FjEUjsb34
- TLSH T14BE4C126EB5414F9E1ABD174CD634902EB727C4D17A0EADF13984A621F236E05F3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 4 IoCs
resource yara_rule behavioral1/memory/2672-3-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral1/memory/2672-4-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral1/memory/2672-2-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral1/memory/2672-1-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2464 set thread context of 2672 2464 KIRA YAGAMI V2.exe 84 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3296 taskmgr.exe Token: SeSystemProfilePrivilege 3296 taskmgr.exe Token: SeCreateGlobalPrivilege 3296 taskmgr.exe Token: SeSecurityPrivilege 3296 taskmgr.exe Token: SeTakeOwnershipPrivilege 3296 taskmgr.exe Token: 33 3296 taskmgr.exe Token: SeIncBasePriorityPrivilege 3296 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2464 wrote to memory of 2672 2464 KIRA YAGAMI V2.exe 84 PID 2464 wrote to memory of 2672 2464 KIRA YAGAMI V2.exe 84 PID 2464 wrote to memory of 2672 2464 KIRA YAGAMI V2.exe 84 PID 2464 wrote to memory of 2672 2464 KIRA YAGAMI V2.exe 84 PID 2464 wrote to memory of 2672 2464 KIRA YAGAMI V2.exe 84 PID 2464 wrote to memory of 2672 2464 KIRA YAGAMI V2.exe 84 PID 2464 wrote to memory of 2672 2464 KIRA YAGAMI V2.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\KIRA YAGAMI V2.exe"C:\Users\Admin\AppData\Local\Temp\KIRA YAGAMI V2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\KIRA YAGAMI V2.exe"C:\Users\Admin\AppData\Local\Temp\KIRA YAGAMI V2.exe"2⤵PID:2672
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3296
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4224