darksiderat | baf879126f78c4b6227bc72c874d0a47bd4a5209f832fa3f215730ee842617d1

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:23

Target
2026-07-31_8f64c92921dc89aeab63447b8142c2eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 724KB
Sample260801-br9bdabe25
SHA256 baf879126f78c4b6227bc72c874d0a47bd4a5209f832fa3f215730ee842617d1
MD5 8f64c92921dc89aeab63447b8142c2eb
SHA1 7da9cd10f142969bb2c04c22da124cf36343c8a2
SHA512 ea741ac915cb7a35a949dfa8d5bb50b123a4477a5b1dddee70d5d09d70e76b52ffe1ecbb2f3490f03568601d370bf4326f6da6e6bceaa717cb7098c8093af1dd
SSDEEP 12288:EtZSmlf/z6Xnhka4ApO3yW12I1aFRGdmzCcKFX/2bTaokP7:EtZSmlHuXnhZ4bCW12IsFRGdmecyXeq
TLSH
T1B3F40783EBB221E8E4F7D13681622327BC723C1983348797A78957265B727E0D97E351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/2712-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2712-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 2712	2416	2026-07-31_8f64c92921dc89aeab63447b8142c2eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2712	2416	2026-07-31_8f64c92921dc89aeab63447b8142c2eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 2416 wrote to memory of 2712	2416	2026-07-31_8f64c92921dc89aeab63447b8142c2eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 2416 wrote to memory of 2712	2416	2026-07-31_8f64c92921dc89aeab63447b8142c2eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 2416 wrote to memory of 2712	2416	2026-07-31_8f64c92921dc89aeab63447b8142c2eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 2416 wrote to memory of 2712	2416	2026-07-31_8f64c92921dc89aeab63447b8142c2eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 2416 wrote to memory of 2712	2416	2026-07-31_8f64c92921dc89aeab63447b8142c2eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 2416 wrote to memory of 2712	2416	2026-07-31_8f64c92921dc89aeab63447b8142c2eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-31_8f64c92921dc89aeab63447b8142c2eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_8f64c92921dc89aeab63447b8142c2eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\2026-07-31_8f64c92921dc89aeab63447b8142c2eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-31_8f64c92921dc89aeab63447b8142c2eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  PID:2712

memory/2416-0-0x0000000140000000-0x00000001400C7000-memory.dmp

Download

memory/2416-3-0x0000000140000000-0x00000001400C7000-memory.dmp

Download

memory/2712-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2712-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download