darksiderat | e8632510a0192891e134e584890046be7b4832e4932fd816f28e72d9455effab

Analysis

user interaction
yes
max time kernel
11s
max time network
13s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/11/2026, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PhantasmNewUi.exe
Size 1.3MB
Sample261109-bhnnbabe75
SHA256 e8632510a0192891e134e584890046be7b4832e4932fd816f28e72d9455effab
MD5 50758b8368700ffc3247e014fda3b97a
SHA1 f0090e125a92afc6cefab1e28f5484696728c7db
SHA512 88765fa027e9ca73d8a630dc4f95f06a4e0d18d7ebce621bfd40c0dabbb6af042aa69cbfb4ac533f5ffc5b9fe3fed6eb1f74aea80b0102e5952757844136b9e3
SSDEEP 12288:5hSpqCPFHXU4yTlTRTUpThTNTs51GRtVB3ZsrEtJ6GjUOkVMyTlTRTUpThTNTs5E:9iAOs8AOsca16Go
TLSH
T16955F72223FC816AE1F76B79947506209BF7BC967B74E79E0694052D0D73B809EA4333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024463-18.dat	family_darksiderat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	3328	PhantasmNewUi.exe

Executes dropped EXE 1 IoCs

pid	Process
3476	ox_1794186667332.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PhantasmNewUi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PhantasmNewUi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ox_1794186667332.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ox_1794186667332.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 2224	3328	PhantasmNewUi.exe	84
PID 2224 wrote to memory of 3476	2224	cmd.exe	86
PID 3476 wrote to memory of 344	3476	ox_1794186667332.exe	94
PID 3476 wrote to memory of 344	3476	ox_1794186667332.exe	94
PID 3476 wrote to memory of 344	3476	ox_1794186667332.exe	94
PID 3476 wrote to memory of 344	3476	ox_1794186667332.exe	94
PID 3476 wrote to memory of 344	3476	ox_1794186667332.exe	94
PID 3476 wrote to memory of 344	3476	ox_1794186667332.exe	94
PID 3476 wrote to memory of 344	3476	ox_1794186667332.exe	94
PID 3476 wrote to memory of 344	3476	ox_1794186667332.exe	94
PID 3476 wrote to memory of 344	3476	ox_1794186667332.exe	94

C:\Users\Admin\AppData\Local\Temp\PhantasmNewUi.exe
"C:\Users\Admin\AppData\Local\Temp\PhantasmNewUi.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1794186667332.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Users\Admin\AppData\Local\Temp\ox_1794186667332.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1794186667332.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:3476
  - - C:\Windows\System32\IESettingSync.exe
      "C:\Windows\System32\IESettingSync.exe"
      4⤵
      PID:344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 573f7f4bb7eb132678d715f5b6facc26d1b7fb8c17435c0c66b218a29ffc4658
MD5 46e259ff5cd62d6d17d42ddb16e7ab2e
SHA1 84d7426f9326baac8e623d450a64d5215d43e4aa
SHA512 ea2fcd59404bf41ff3771a8b91585a1fd721fb0ed0d13bd08ea54b9cd1644a9ee601b4797187187e812c3a007d421230cbb112440ef3e45e924e5e54418ab3b1
TLSH
T1F8C08C1C1AA20A0AF2A843BD62D139039B608111E2418F091AF13A08C996B162838F2A
MD5 SHA1 SHA512 TLSH

Submit Download

Retev[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LM36AMZP\Retev[1].htm
Size 56KB
SHA256 c5479d3935762ad5280b2fa5f0fd7bb6395eaeea74fb79d2bfc695770b8d374c
MD5 3c0f2e862d3799f086b241052fa3d80f
SHA1 2d108a671f306aac61b56356b0170a7db59554ec
SHA512 25dfc86cb2e79235a046dfd1c4212e58126b9e7188140616be1d1de2bb77606019e5c8fc2450b713b013ffdf501683398a794e9afbcac36bf5b7c7d8857c2d6c
SSDEEP 768:0bC1NA10jzCHGMWQ8+9AxkUjFzaOWp54vg5d5YP98yxA1XbXxFkW7rCVr8Z0kP:Yr0jzE6bWp0g5rBSmNGW7rCVoekP
TLSH
T13743F935E95EB06FE35DC870ED030D16CD127CCA97A0BB9B57914DE20EAAE609B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/344-40-0x000002160E600000-0x000002160ED19000-memory.dmp

Download

memory/344-41-0x000002160ED20000-0x000002160ED21000-memory.dmp

Download

memory/344-47-0x000002160E600000-0x000002160ED19000-memory.dmp

Download

memory/344-53-0x000002160E600000-0x000002160ED19000-memory.dmp

Download

memory/344-56-0x000002160E600000-0x000002160ED19000-memory.dmp

Download

memory/3328-0-0x0000000140000000-0x0000000140046000-memory.dmp

Download

memory/3328-22-0x0000000140000000-0x0000000140046000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads