darksiderat | 8d7697b402a37f47a375e69835334d01a4764dcc488ac75a25393d50b9b74e6f

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:10

Target
2026-08-03_cf9f628476e4a158bc5d2fbfe99bf00d_cobalt-strike_conti.exe
Size 87KB
Sample260803-cl1byswfkf
SHA256 8d7697b402a37f47a375e69835334d01a4764dcc488ac75a25393d50b9b74e6f
MD5 cf9f628476e4a158bc5d2fbfe99bf00d
SHA1 eb527e146ca74d484d867347161bc8869cf7669f
SHA512 278b63f1b18c85e6a188f0540c9dc466f376fc07057189ee6a8ac5bad5e11b5eca13e16598804e95b5919f2b38bea07787d53fa0b37f551dff2552fa313dcc1d
SSDEEP 1536:1wknN9i4LsvrK4MbjarcKWlFo7AG8Du6+WSss/eYwp:11niWsrK4MburcDlFoUY6+WSvm
TLSH
T1A6938D06D79684FDD79FE278C4A3477BE432BC254260E97F1618F2322E70E509A2E635
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/1880-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1880-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1272 set thread context of 1880	1272	2026-08-03_cf9f628476e4a158bc5d2fbfe99bf00d_cobalt-strike_conti.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1880	1272	2026-08-03_cf9f628476e4a158bc5d2fbfe99bf00d_cobalt-strike_conti.exe	90
PID 1272 wrote to memory of 1880	1272	2026-08-03_cf9f628476e4a158bc5d2fbfe99bf00d_cobalt-strike_conti.exe	90
PID 1272 wrote to memory of 1880	1272	2026-08-03_cf9f628476e4a158bc5d2fbfe99bf00d_cobalt-strike_conti.exe	90
PID 1272 wrote to memory of 1880	1272	2026-08-03_cf9f628476e4a158bc5d2fbfe99bf00d_cobalt-strike_conti.exe	90
PID 1272 wrote to memory of 1880	1272	2026-08-03_cf9f628476e4a158bc5d2fbfe99bf00d_cobalt-strike_conti.exe	90
PID 1272 wrote to memory of 1880	1272	2026-08-03_cf9f628476e4a158bc5d2fbfe99bf00d_cobalt-strike_conti.exe	90
PID 1272 wrote to memory of 1880	1272	2026-08-03_cf9f628476e4a158bc5d2fbfe99bf00d_cobalt-strike_conti.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-03_cf9f628476e4a158bc5d2fbfe99bf00d_cobalt-strike_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_cf9f628476e4a158bc5d2fbfe99bf00d_cobalt-strike_conti.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_cf9f628476e4a158bc5d2fbfe99bf00d_cobalt-strike_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_cf9f628476e4a158bc5d2fbfe99bf00d_cobalt-strike_conti.exe"
  2⤵
  PID:1880

memory/1272-0-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/1272-4-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/1880-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1880-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download