darksiderat | 430ccaa8262bee0e9262655d56122b88150f5de65fe414aedd99d027594819ed

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe
Size 1.1MB
Sample260809-ak621afk7x
SHA256 430ccaa8262bee0e9262655d56122b88150f5de65fe414aedd99d027594819ed
MD5 50a9e89ce38d5544e9431f034e57be21
SHA1 9241ad3918c2a059e1589c5423d8452b31cdad14
SHA512 5f5a54eb3125020419036a3c9860c34fd7d22b28e0383cb17b0a2b1097e9cb87afdf8a31f1ce0cf6ba67bfabf0e71d849ed77d4c02b2e5ee51fcd9affd7d4644
SSDEEP 24576:jIQhn58EdsU9Jl5lBv6SlBJWJ6b58wf/aInFzz:0Qhn586scv6SlBJWJ618wf9nFX
TLSH
T151358C1BFB91A26DD59EC0B483069972A575B8CD0231BCBF05E593343EA9E610F2DB1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral2/memory/5368-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2764 set thread context of 5368	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	90
PID 2764 set thread context of 1184	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	92
PID 2764 set thread context of 2788	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	91

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2788	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	91
PID 2764 wrote to memory of 2788	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	91
PID 2764 wrote to memory of 2788	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	91
PID 2764 wrote to memory of 2788	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	91
PID 2764 wrote to memory of 2788	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	91
PID 2764 wrote to memory of 2788	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	91
PID 2764 wrote to memory of 2788	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	91
PID 2764 wrote to memory of 5368	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	90
PID 2764 wrote to memory of 5368	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	90
PID 2764 wrote to memory of 5368	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	90
PID 2764 wrote to memory of 5368	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	90
PID 2764 wrote to memory of 5368	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	90
PID 2764 wrote to memory of 5368	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	90
PID 2764 wrote to memory of 5368	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	90
PID 2764 wrote to memory of 1184	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	92
PID 2764 wrote to memory of 1184	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	92
PID 2764 wrote to memory of 1184	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	92
PID 2764 wrote to memory of 1184	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	92
PID 2764 wrote to memory of 1184	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	92
PID 2764 wrote to memory of 1184	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	92
PID 2764 wrote to memory of 1184	2764	2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe"
  2⤵
  PID:5368
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe"
  2⤵
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_50a9e89ce38d5544e9431f034e57be21_akira.exe"
  2⤵
  PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2764-0-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/2764-4-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/5368-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads