darksiderat | 959b430ca4e378bfdf9c16087ca1dfdcc2c4022703781ce7825b717dd8031ea8

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:33

Target
2026-07-31_469b8564a406d9b7767c130f3379946e_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 281KB
Sample260801-byzeravdqa
SHA256 959b430ca4e378bfdf9c16087ca1dfdcc2c4022703781ce7825b717dd8031ea8
MD5 469b8564a406d9b7767c130f3379946e
SHA1 4dbab74ccc3e244508a532ffff98b08e789348b7
SHA512 fcfbd86c2311351c8f5935bc22870019f16d9687f1c32dd03202ebafff36b97a4abb39cbcda4638088ee2034325e95e44d1ce673d4be25644f67211463ef4cf4
SSDEEP 3072:YnGk/AvastVgkz+YPkqXT2QFy16vQNK5X22XmFhlIW4OIwMpdCq/IM8uIGfs/9SI:gGQuasPKCGE0DkuSOIwMd7wvco
TLSH
T1A0545B02F36D3DEDE06AC134897155A2AB31FC311750968F53E57B662E32293BD2AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/2832-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2832-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3444 set thread context of 2832	3444	2026-07-31_469b8564a406d9b7767c130f3379946e_cobalt-strike_icedid_luca-stealer_njrat.exe	88

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 2832	3444	2026-07-31_469b8564a406d9b7767c130f3379946e_cobalt-strike_icedid_luca-stealer_njrat.exe	88
PID 3444 wrote to memory of 2832	3444	2026-07-31_469b8564a406d9b7767c130f3379946e_cobalt-strike_icedid_luca-stealer_njrat.exe	88
PID 3444 wrote to memory of 2832	3444	2026-07-31_469b8564a406d9b7767c130f3379946e_cobalt-strike_icedid_luca-stealer_njrat.exe	88
PID 3444 wrote to memory of 2832	3444	2026-07-31_469b8564a406d9b7767c130f3379946e_cobalt-strike_icedid_luca-stealer_njrat.exe	88
PID 3444 wrote to memory of 2832	3444	2026-07-31_469b8564a406d9b7767c130f3379946e_cobalt-strike_icedid_luca-stealer_njrat.exe	88
PID 3444 wrote to memory of 2832	3444	2026-07-31_469b8564a406d9b7767c130f3379946e_cobalt-strike_icedid_luca-stealer_njrat.exe	88
PID 3444 wrote to memory of 2832	3444	2026-07-31_469b8564a406d9b7767c130f3379946e_cobalt-strike_icedid_luca-stealer_njrat.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-31_469b8564a406d9b7767c130f3379946e_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_469b8564a406d9b7767c130f3379946e_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\Temp\2026-07-31_469b8564a406d9b7767c130f3379946e_cobalt-strike_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-31_469b8564a406d9b7767c130f3379946e_cobalt-strike_icedid_luca-stealer_njrat.exe"
  2⤵
  PID:2832

memory/2832-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2832-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3444-0-0x0000000140000000-0x0000000140073000-memory.dmp

Download

memory/3444-3-0x0000000140000000-0x0000000140073000-memory.dmp

Download