darksiderat | bd204fa8ade68f32fe494849bcdf342a22c54e339abab66c99907b48ffb11139

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 04:49

Target
2026-08-09_e2358693ba41263f6dba1e1a0343d36a_conti.exe
Size 56KB
Sample260809-ffw9ws1alf
SHA256 bd204fa8ade68f32fe494849bcdf342a22c54e339abab66c99907b48ffb11139
MD5 e2358693ba41263f6dba1e1a0343d36a
SHA1 392698a4e2c303a9e7d29ab45f63810c5c9fc066
SHA512 98ad4969fd4875ab81797eaa62df2071fbaaf3b2e89aab7c390b9d79933fb2ab5b443639dd1831e0d55c97061202625965e8b00b35223460ffc9709570f504cd
SSDEEP 768:wzhnHHbnOcYvSFN6WhfJRit5c3JfwOb1xgBXG8Drapk+WSssfcceYKcOY2tig:wzNHbOdaCWh77AG8Du6+WSss/eYwp
TLSH
T1A9439E54EF5704EED1ADE0B8D0E347B3F532BC1642A0D9B61241F2361F70F929A6E616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/2292-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2292-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3308 set thread context of 2292	3308	2026-08-09_e2358693ba41263f6dba1e1a0343d36a_conti.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 2292	3308	2026-08-09_e2358693ba41263f6dba1e1a0343d36a_conti.exe	89
PID 3308 wrote to memory of 2292	3308	2026-08-09_e2358693ba41263f6dba1e1a0343d36a_conti.exe	89
PID 3308 wrote to memory of 2292	3308	2026-08-09_e2358693ba41263f6dba1e1a0343d36a_conti.exe	89
PID 3308 wrote to memory of 2292	3308	2026-08-09_e2358693ba41263f6dba1e1a0343d36a_conti.exe	89
PID 3308 wrote to memory of 2292	3308	2026-08-09_e2358693ba41263f6dba1e1a0343d36a_conti.exe	89
PID 3308 wrote to memory of 2292	3308	2026-08-09_e2358693ba41263f6dba1e1a0343d36a_conti.exe	89
PID 3308 wrote to memory of 2292	3308	2026-08-09_e2358693ba41263f6dba1e1a0343d36a_conti.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_e2358693ba41263f6dba1e1a0343d36a_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_e2358693ba41263f6dba1e1a0343d36a_conti.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_e2358693ba41263f6dba1e1a0343d36a_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-09_e2358693ba41263f6dba1e1a0343d36a_conti.exe"
  2⤵
  PID:2292

memory/2292-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2292-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3308-0-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/3308-5-0x0000000140000000-0x0000000140022000-memory.dmp

Download