darksiderat | 2e92db509e6abad1a77e5e358eea2ca6691e49a962e743b9cee827f3427fc049

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:57

Target
2026-08-03_138c62ea5a5c07a2d24cbfcf6db8d86c_cobalt-strike_conti.exe
Size 288KB
Sample260803-df2s9sbl3t
SHA256 2e92db509e6abad1a77e5e358eea2ca6691e49a962e743b9cee827f3427fc049
MD5 138c62ea5a5c07a2d24cbfcf6db8d86c
SHA1 907fd7277fe871dbb35cd8aaf6b6636914e4673b
SHA512 04fba5e5146408cf4605f26723ce5609f6b986e0e9fadd03fb80efd1fbfbe328ebd752a560f7004cf442b384c7020ea35fd1049549fb43ee510a9448e7a5d9d5
SSDEEP 3072:vv/Ek4UX6VcK57c9i8KQYCLa5U25dyISczk5E9u6LRZUY6+WSvm:v0klX6c9RYC4JdyISczYE9u6Lg
TLSH
T153548C19E79258FCC1AED1B8C5939FB2E573BC2543A0AAEF0350E2335D32AD09D3A515
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4740-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4740-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5104 set thread context of 4740	5104	2026-08-03_138c62ea5a5c07a2d24cbfcf6db8d86c_cobalt-strike_conti.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4740	5104	2026-08-03_138c62ea5a5c07a2d24cbfcf6db8d86c_cobalt-strike_conti.exe	90
PID 5104 wrote to memory of 4740	5104	2026-08-03_138c62ea5a5c07a2d24cbfcf6db8d86c_cobalt-strike_conti.exe	90
PID 5104 wrote to memory of 4740	5104	2026-08-03_138c62ea5a5c07a2d24cbfcf6db8d86c_cobalt-strike_conti.exe	90
PID 5104 wrote to memory of 4740	5104	2026-08-03_138c62ea5a5c07a2d24cbfcf6db8d86c_cobalt-strike_conti.exe	90
PID 5104 wrote to memory of 4740	5104	2026-08-03_138c62ea5a5c07a2d24cbfcf6db8d86c_cobalt-strike_conti.exe	90
PID 5104 wrote to memory of 4740	5104	2026-08-03_138c62ea5a5c07a2d24cbfcf6db8d86c_cobalt-strike_conti.exe	90
PID 5104 wrote to memory of 4740	5104	2026-08-03_138c62ea5a5c07a2d24cbfcf6db8d86c_cobalt-strike_conti.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-03_138c62ea5a5c07a2d24cbfcf6db8d86c_cobalt-strike_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_138c62ea5a5c07a2d24cbfcf6db8d86c_cobalt-strike_conti.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_138c62ea5a5c07a2d24cbfcf6db8d86c_cobalt-strike_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_138c62ea5a5c07a2d24cbfcf6db8d86c_cobalt-strike_conti.exe"
  2⤵
  PID:4740

memory/4740-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4740-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5104-0-0x0000000140000000-0x0000000140055000-memory.dmp

Download

memory/5104-4-0x0000000140000000-0x0000000140055000-memory.dmp

Download