darksiderat | 7544945b42fd132e95d0596cbb3edd2abe438f7bb20f7f4dfb631d963626efe2

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe
Size 316KB
Sample260804-l5aebahc85
SHA256 7544945b42fd132e95d0596cbb3edd2abe438f7bb20f7f4dfb631d963626efe2
MD5 b5929e8b2ff562e6d8c96854b030e295
SHA1 60522d6605eced44e7676350eaf82e78e4b3af5f
SHA512 a807cea8fdc809029033af0f6c22d44d0de7d2a100cb3d3bbd6899fad4b737371a55a57accc08a9eaaf2bf51ceaebefbc78b301a31230d622d9cffe9250f225f
SSDEEP 3072:LlVo5S75t7ppXF87PoDR4iVYFejwG4vvmzQ80Ulb7I3vUY6+WSvm:Ll+e9pp1+hcYFefcXU17I34
TLSH
T1FE647D17EB9630FEE27A9638C9520D41EB72B8654761ABDF03804AA61F237C09F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/4228-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4228-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/files/0x000d00000001c333-22.dat	family_darksiderat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	4260	2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe

Executes dropped EXE 1 IoCs

pid	Process
1808	ox_1785838034614.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4260 set thread context of 4228	4260	2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe	89

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4228	4260	2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe	89
PID 4260 wrote to memory of 4228	4260	2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe	89
PID 4260 wrote to memory of 4228	4260	2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe	89
PID 4260 wrote to memory of 4228	4260	2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe	89
PID 4260 wrote to memory of 4228	4260	2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe	89
PID 4260 wrote to memory of 4228	4260	2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe	89
PID 4260 wrote to memory of 4228	4260	2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe	89
PID 4260 wrote to memory of 1272	4260	2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe	90
PID 1272 wrote to memory of 1808	1272	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_b5929e8b2ff562e6d8c96854b030e295_cobalt-strike_icedid_njrat_satacom.exe"
  2⤵
  PID:4228
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1785838034614.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Users\Admin\AppData\Local\Temp\ox_1785838034614.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1785838034614.exe
    3⤵
    - Executes dropped EXE
    PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ox_1785838034614.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1785838034614.exe
Size 67KB
SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
MD5 32b268f7114cd6816d3b1c0558e88f95
SHA1 1d0caf4582173eb45e0be05134ed432a21f5af55
SHA512 9b453ea4ac1ec6f216629ca16654e78f02fb61af8158eb3153e3fbecaae8e78b50c53242c4e76a93d59f3f3150392805a18892b103cd689d6814c7984b5e866b
SSDEEP 768:d8w6iBGb+IyfJoTOBPca/CCNNl1uHBNdXIBMEB44w7Fv6NDzSkzNT2L:PIyfiTOpZNiMMuw7Z6NDzPNTI
TLSH
T18363E735C9A9B13FD3199C78DE060D84DF62BC8A4784BF97A7D11CE60F92A902F1D681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4228-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4228-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4260-0-0x0000000140000000-0x000000014005C000-memory.dmp

Download

memory/4260-24-0x0000000140000000-0x000000014005C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads