darksiderat | 71c54ee8c6b96168b5fd15a23d9ee2f9b8ab49e79d4e95635613fbe0bff317dc

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe
Size 764KB
Sample260801-md4drahb83
SHA256 71c54ee8c6b96168b5fd15a23d9ee2f9b8ab49e79d4e95635613fbe0bff317dc
MD5 f72ef411d2a687dceb9eece452341fe0
SHA1 47c49a73198b4acb6fdc43c064f64851c10ab9c2
SHA512 95be3472a9fcd3786338a34e6c0661b90e5b1e9508404c40e39c8f9cb855a3fa2beae3ed742857d23fc19e7a975ae321e777ce31916d8de6a4ee0da1f89afabc
SSDEEP 12288:4SiZbbSoCU5qJSr1eWPUntBB0sP0MugCAjHUzTsxEXU:4Si1SoCU5qJSr1eWPSCsP0MugC6eTq
TLSH
T124F48D5AB79016FAD17BD23DCA424A56EA7278064720E78F03A547A71F233615F3F322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/4104-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4104-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/files/0x000b00000001c6e9-21.dat	family_darksiderat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	6708	2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe

Executes dropped EXE 1 IoCs

pid	Process
2344	ox_1785579762737.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6708 set thread context of 4104	6708	2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe	89

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 6708 wrote to memory of 4104	6708	2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe	89
PID 6708 wrote to memory of 4104	6708	2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe	89
PID 6708 wrote to memory of 4104	6708	2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe	89
PID 6708 wrote to memory of 4104	6708	2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe	89
PID 6708 wrote to memory of 4104	6708	2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe	89
PID 6708 wrote to memory of 4104	6708	2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe	89
PID 6708 wrote to memory of 4104	6708	2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe	89
PID 6708 wrote to memory of 1772	6708	2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe	90
PID 1772 wrote to memory of 2344	1772	cmd.exe	92
PID 2344 wrote to memory of 6548	2344	ox_1785579762737.exe	93
PID 2344 wrote to memory of 6548	2344	ox_1785579762737.exe	93
PID 2344 wrote to memory of 6548	2344	ox_1785579762737.exe	93
PID 2344 wrote to memory of 6548	2344	ox_1785579762737.exe	93
PID 2344 wrote to memory of 6548	2344	ox_1785579762737.exe	93
PID 2344 wrote to memory of 6548	2344	ox_1785579762737.exe	93
PID 2344 wrote to memory of 6548	2344	ox_1785579762737.exe	93
PID 2344 wrote to memory of 6548	2344	ox_1785579762737.exe	93
PID 2344 wrote to memory of 6548	2344	ox_1785579762737.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:6708
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-01_f72ef411d2a687dceb9eece452341fe0_icedid_njrat.exe"
  2⤵
  PID:4104
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1785579762737.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Users\Admin\AppData\Local\Temp\ox_1785579762737.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1785579762737.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\System32\DiskSnapshot.exe
      "C:\Windows\System32\DiskSnapshot.exe"
      4⤵
      PID:6548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ox_1785579762737.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1785579762737.exe
Size 56KB
SHA256 47c72580795661e45c4ea0dcc31954cc63467f149e013fb77a6816ad67ac2750
MD5 1dfcd6d0690c4eb10a99b19eb0fd05e9
SHA1 dd58e6af2871c70a4532fc7d7bd8a56f7f47966e
SHA512 ada4387e34541c59147672146f6189766855ab2edebbad0dbba83b85339b69dc3a08dfc6a2716f6460f3afc4c93607fbe5bb22739920374e4f37ce8c00a92836
SSDEEP 768:RUcqx3pSuSDFfQYqXKmEXNt+VtzOOWp54vg5d5YP98yxA1XbXy/kW7rCVr8Z0kP:6WuWbpb+tWp0g5rBSm2sW7rCVoekP
TLSH
T1CD43F834EA5EB06FD359D830DD430D16DD52BCCA97A0BB9B57910DD20EAAF209B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4104-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4104-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/6548-57-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-60-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-34-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-35-0x00000290429A0000-0x00000290429A1000-memory.dmp

Download

memory/6548-41-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-51-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-54-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-48-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-56-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-46-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-59-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-58-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-55-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-52-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-53-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-50-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-49-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6548-47-0x0000029042280000-0x0000029042999000-memory.dmp

Download

memory/6708-33-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/6708-0-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads