darksiderat | 28490f89c78c73680655f3be55605db6b010d6db729914d1174930120ed15d1f

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:13

Target
2026-07-31_ddae591101417f2fd8d963431c0bff4c_conti.exe
Size 85KB
Sample260801-blh71avbng
SHA256 28490f89c78c73680655f3be55605db6b010d6db729914d1174930120ed15d1f
MD5 ddae591101417f2fd8d963431c0bff4c
SHA1 fa03649bc5a30039cb0b92b837bac6edd61f732f
SHA512 93af4753b696b6b6ca0571c90a41d54ffc7a0362ffd7a72b031d113cc883aa738cb3e8607907347841e197f01cf7e59b8ffcf4bd41d9ed3dfdfbe51b08a1ffbd
SSDEEP 1536:xIqouj8UEkCMctemNIQWSp7AG8Du6+WSss/eYwp:xIqouQyiemYSpUY6+WSvm
TLSH
T1AA837D05FB9314FDD6AED1B891E34AB3F832BC150164DD7F9290E3361E30E51AA1D626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/1308-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1308-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4504 set thread context of 1308	4504	2026-07-31_ddae591101417f2fd8d963431c0bff4c_conti.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 1308	4504	2026-07-31_ddae591101417f2fd8d963431c0bff4c_conti.exe	90
PID 4504 wrote to memory of 1308	4504	2026-07-31_ddae591101417f2fd8d963431c0bff4c_conti.exe	90
PID 4504 wrote to memory of 1308	4504	2026-07-31_ddae591101417f2fd8d963431c0bff4c_conti.exe	90
PID 4504 wrote to memory of 1308	4504	2026-07-31_ddae591101417f2fd8d963431c0bff4c_conti.exe	90
PID 4504 wrote to memory of 1308	4504	2026-07-31_ddae591101417f2fd8d963431c0bff4c_conti.exe	90
PID 4504 wrote to memory of 1308	4504	2026-07-31_ddae591101417f2fd8d963431c0bff4c_conti.exe	90
PID 4504 wrote to memory of 1308	4504	2026-07-31_ddae591101417f2fd8d963431c0bff4c_conti.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-31_ddae591101417f2fd8d963431c0bff4c_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_ddae591101417f2fd8d963431c0bff4c_conti.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\Temp\2026-07-31_ddae591101417f2fd8d963431c0bff4c_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-31_ddae591101417f2fd8d963431c0bff4c_conti.exe"
  2⤵
  PID:1308

memory/1308-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1308-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4504-0-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/4504-5-0x0000000140000000-0x0000000140029000-memory.dmp

Download