Analysis
- user interaction
yes - max time kernel
31s - max time network
24s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/09/2026, 12:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
account gen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
account gen.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target account gen.exe
- Size 368KB
- Sample260915-p7ch8sxeqb
- SHA256 be8ffa2deeb1ad590f371dfc031c4701010de583a091b9e9ad81e5d421ebbee0
- MD5 93b152ddba79f433c3a17fa907c01a06
- SHA1 8cce14920662a7c2ffc3595bb625ef5e7603735a
- SHA512 e85dbb45c4b40bd67b0594ddc6cb96f717ce98dab7c4a2147e42225e89fef1076b56a1303653c80209c42c03535df817e05735a7706096da0ce65c362aab6126
- SSDEEP 6144:QwR3cLrvZBKCGfiRm/6nEVAQFXOhEwYRfZuy6MTI1Ng1NdiSKRa58z8SsD:QW3mkSRSFAQ4q14Jr7sdi1Ram
- TLSH T12984231453DF95A3D87578339E6642B44B3FBA9E4D86AB2363CC1DB8AB16784FD90003
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c4fa-11.dat family_darksiderat - Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 2576 created 3736 2576 account gen.exe 81 PID 2576 created 3736 2576 account gen.exe 81 - Executes dropped EXE 1 IoCs
pid Process 5928 Loader.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2576 set thread context of 1188 2576 account gen.exe 87 PID 2576 set thread context of 3388 2576 account gen.exe 88 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4920 taskmgr.exe Token: SeSystemProfilePrivilege 4920 taskmgr.exe Token: SeCreateGlobalPrivilege 4920 taskmgr.exe - Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe - Suspicious use of SendNotifyMessage 41 IoCs
pid Process 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4920 taskmgr.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2576 wrote to memory of 1188 2576 account gen.exe 87 PID 2576 wrote to memory of 1188 2576 account gen.exe 87 PID 2576 wrote to memory of 1188 2576 account gen.exe 87 PID 2576 wrote to memory of 1188 2576 account gen.exe 87 PID 2576 wrote to memory of 1188 2576 account gen.exe 87 PID 2576 wrote to memory of 1188 2576 account gen.exe 87 PID 2576 wrote to memory of 1188 2576 account gen.exe 87 PID 2576 wrote to memory of 1188 2576 account gen.exe 87 PID 2576 wrote to memory of 3388 2576 account gen.exe 88 PID 2576 wrote to memory of 3388 2576 account gen.exe 88 PID 2576 wrote to memory of 3388 2576 account gen.exe 88 PID 2576 wrote to memory of 3388 2576 account gen.exe 88 PID 2576 wrote to memory of 3388 2576 account gen.exe 88 PID 2576 wrote to memory of 3388 2576 account gen.exe 88 PID 2576 wrote to memory of 3388 2576 account gen.exe 88 PID 2576 wrote to memory of 5928 2576 account gen.exe 89
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\account gen.exe"C:\Users\Admin\AppData\Local\Temp\account gen.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"3⤵
- Executes dropped EXE
PID:5928
-
-
-
C:\Users\Admin\AppData\Local\Temp\account gen.exe"C:\Users\Admin\AppData\Local\Temp\account gen.exe"2⤵PID:1188
-
-
C:\Users\Admin\AppData\Local\Temp\account gen.exe"C:\Users\Admin\AppData\Local\Temp\account gen.exe"2⤵PID:3388
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4920
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3568
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Loader.exe
- Size 87KB
- SHA256 7a2f38df13d43bc270d4a4d7fa532313a2a8353d1e785c8ad686868b11b4265f
- MD5 4d14d43605dbe974dea0a0d8afc81d60
- SHA1 903b3f0a8b72de3176ff7bcaaa06ca3499df5f0a
- SHA512 b78e22ded4d91fd25bf2197f003b0967c38be78dcb628ff4631c9622989a2abf80f57b97aeb920f6025b7324a01912e402fd33bec2b9614e3a1354e088647d36
- SSDEEP 768:nv4Dh3rZbHU5OjOar7uL/AGof1J7DtZl++J6dhz8agz88W9CcCyegMxJMcgkzq7v:Uh34z9Y+97kehomTkfrJrjolYu1l/
- TLSH T19C93F535DA9AB16FC2498478ED024C06DF53B89E8661BF672BD24DC54FCAF602F2C590
- MD5 SHA1 SHA512 SSDEEP TLSH