darksiderat | 6b05e235df4a7d577484787e686e54be6ff27740d6aba56365b987fbbd49a9a3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:12

Target
2026-07-31_edbe0d227216cf705d61f0b0516c8a86_icedid_njrat_vidar.exe
Size 226KB
Sample260801-bkkdnstyhz
SHA256 6b05e235df4a7d577484787e686e54be6ff27740d6aba56365b987fbbd49a9a3
MD5 edbe0d227216cf705d61f0b0516c8a86
SHA1 65ad442ec267b783c2ef4869a124395057a12790
SHA512 db40e309200b38c4d8e70e1df3c1ee25403a0dd3047a4da673664d9ad272ff4ed32c4d582d984b9ef083b09792e3b1698b6dffff429a6b9f5ba9dcc04aaf7d9f
SSDEEP 3072:SgIblkVBgDGGKVAMD8JSJ/K9nBSE2bngM7nNDNNnPUMEGuaJD7XUY6+WSvm:ST5ABELEJ/KhAE4xNDNNnPj7w
TLSH
T11E347C84B7A154FAF07AC134C97185A7D6727C560B608B9F2394736E9F33690AE3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/1804-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1804-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6128 set thread context of 1804	6128	2026-07-31_edbe0d227216cf705d61f0b0516c8a86_icedid_njrat_vidar.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 1804	6128	2026-07-31_edbe0d227216cf705d61f0b0516c8a86_icedid_njrat_vidar.exe	90
PID 6128 wrote to memory of 1804	6128	2026-07-31_edbe0d227216cf705d61f0b0516c8a86_icedid_njrat_vidar.exe	90
PID 6128 wrote to memory of 1804	6128	2026-07-31_edbe0d227216cf705d61f0b0516c8a86_icedid_njrat_vidar.exe	90
PID 6128 wrote to memory of 1804	6128	2026-07-31_edbe0d227216cf705d61f0b0516c8a86_icedid_njrat_vidar.exe	90
PID 6128 wrote to memory of 1804	6128	2026-07-31_edbe0d227216cf705d61f0b0516c8a86_icedid_njrat_vidar.exe	90
PID 6128 wrote to memory of 1804	6128	2026-07-31_edbe0d227216cf705d61f0b0516c8a86_icedid_njrat_vidar.exe	90
PID 6128 wrote to memory of 1804	6128	2026-07-31_edbe0d227216cf705d61f0b0516c8a86_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-31_edbe0d227216cf705d61f0b0516c8a86_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_edbe0d227216cf705d61f0b0516c8a86_icedid_njrat_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Users\Admin\AppData\Local\Temp\2026-07-31_edbe0d227216cf705d61f0b0516c8a86_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-31_edbe0d227216cf705d61f0b0516c8a86_icedid_njrat_vidar.exe"
  2⤵
  PID:1804

memory/1804-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1804-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/6128-0-0x0000000140000000-0x0000000140049000-memory.dmp

Download

memory/6128-3-0x0000000140000000-0x0000000140049000-memory.dmp

Download