darksiderat | a10456a516a4ad8d5f0a92828673f88445eb2f440b63373e780da9dedefdba25

Analysis

geolocation tags

asiadelhiinindia
max time kernel
60s
max time network
54s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 15:44

Target
test.exe
Size 556KB
Sample260802-s6xpkawcle
SHA256 a10456a516a4ad8d5f0a92828673f88445eb2f440b63373e780da9dedefdba25
MD5 3599f94d0f6de03d51f44b768faf1e17
SHA1 18b42792ace03ed4c43f8a99c9d733a5ddc2c824
SHA512 309e8d0b2e325f821946315a4cd979956927b0df3d9749f32a6a4fa68e41402a131e0dfb17a3c9e60b0ab70becaa09cbb0eb94c910f4b5793e1b160e4c36d530
SSDEEP 12288:0qf2gsPAOOcjdQ/tTsrkgs/Wh/7xzHfVO0vzmEl:92g+jS/tTsggIWh/7xzHfVFzz
TLSH
T194C49E19DF6504B8E07ED1B8CA678443F7727C8D0375DAE71BD49AA21F264D0AA7EE00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4592-3-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4592-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3600 set thread context of 5056	3600	test.exe	91
PID 3600 set thread context of 4592	3600	test.exe	92

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 5056	3600	test.exe	91
PID 3600 wrote to memory of 5056	3600	test.exe	91
PID 3600 wrote to memory of 5056	3600	test.exe	91
PID 3600 wrote to memory of 5056	3600	test.exe	91
PID 3600 wrote to memory of 5056	3600	test.exe	91
PID 3600 wrote to memory of 5056	3600	test.exe	91
PID 3600 wrote to memory of 5056	3600	test.exe	91
PID 3600 wrote to memory of 4592	3600	test.exe	92
PID 3600 wrote to memory of 4592	3600	test.exe	92
PID 3600 wrote to memory of 4592	3600	test.exe	92
PID 3600 wrote to memory of 4592	3600	test.exe	92
PID 3600 wrote to memory of 4592	3600	test.exe	92
PID 3600 wrote to memory of 4592	3600	test.exe	92
PID 3600 wrote to memory of 4592	3600	test.exe	92

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\test.exe
  "C:\Users\Admin\AppData\Local\Temp\test.exe"
  2⤵
  PID:5056
- C:\Users\Admin\AppData\Local\Temp\test.exe
  "C:\Users\Admin\AppData\Local\Temp\test.exe"
  2⤵
  PID:4592

memory/3600-0-0x0000000140000000-0x000000014009C000-memory.dmp

Download

memory/3600-5-0x0000000140000000-0x000000014009C000-memory.dmp

Download

memory/4592-3-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4592-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5056-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/5056-4-0x0000000140000000-0x0000000140050000-memory.dmp

Download