darksiderat | d8bf25a9d985db3ef61892741e40e9e219f5abdf4f0ce551311eb009a02b0210

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 17:20

Target
2026-08-06_49523a7d4f33cf21fe196c207b087f1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 4.9MB
Sample260806-vwegcazyev
SHA256 d8bf25a9d985db3ef61892741e40e9e219f5abdf4f0ce551311eb009a02b0210
MD5 49523a7d4f33cf21fe196c207b087f1b
SHA1 0f805d82937011df6d087b1e4d16ef0e4fa42091
SHA512 0475439e7b561b41d32831875355ffa855811fbe0a2f627eab9cbca31c70a3f7d0ad403fa290a8945fbb84c2c6f23291812be21cbaf9080d28707c5a51124048
SSDEEP 98304:yuxa9RFkBEWwMR6Hrky7oRQSrJDj2Ai/5gU5tD9IEfJxzGPJ3NPxTRitS9:yuRBEWV2r4QqyBPD3hxyJ3NtRig
TLSH
T146363389E76205FAE9E6203E8153C015A6B27CD39731CADF1BA881672F275D21C3B771
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/6076-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/6076-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 996 set thread context of 6076	996	2026-08-06_49523a7d4f33cf21fe196c207b087f1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	88

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 6076	996	2026-08-06_49523a7d4f33cf21fe196c207b087f1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	88
PID 996 wrote to memory of 6076	996	2026-08-06_49523a7d4f33cf21fe196c207b087f1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	88
PID 996 wrote to memory of 6076	996	2026-08-06_49523a7d4f33cf21fe196c207b087f1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	88
PID 996 wrote to memory of 6076	996	2026-08-06_49523a7d4f33cf21fe196c207b087f1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	88
PID 996 wrote to memory of 6076	996	2026-08-06_49523a7d4f33cf21fe196c207b087f1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	88
PID 996 wrote to memory of 6076	996	2026-08-06_49523a7d4f33cf21fe196c207b087f1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	88
PID 996 wrote to memory of 6076	996	2026-08-06_49523a7d4f33cf21fe196c207b087f1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-06_49523a7d4f33cf21fe196c207b087f1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_49523a7d4f33cf21fe196c207b087f1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Temp\2026-08-06_49523a7d4f33cf21fe196c207b087f1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-06_49523a7d4f33cf21fe196c207b087f1b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  PID:6076

memory/996-0-0x0000000140000000-0x00000001404FB000-memory.dmp

Download

memory/996-3-0x0000000140000000-0x00000001404FB000-memory.dmp

Download

memory/6076-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/6076-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download