darksiderat | d3fae0d7b11f62d64a02491f13f8259aeebf2ec5411f2e60cda3347851c86e4b

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 05:15

Target
2026-08-09_894991138196d7c5a3b1582dbecdfeb1_conti.exe
Size 274KB
Sample260809-fxp7xavset
SHA256 d3fae0d7b11f62d64a02491f13f8259aeebf2ec5411f2e60cda3347851c86e4b
MD5 894991138196d7c5a3b1582dbecdfeb1
SHA1 9045d4f3ede1d85999496aefee39914cbf28c2a0
SHA512 14ef65426b758a212529c8b951d7649f95cdd2151148660b83e57d3259a0f76d3395970945f7f7b75e4af0853f7870de12b2e8587e9ffba16c9581f149381e6e
SSDEEP 3072:RW5HRlVYcZzocTfr8SYPtL6LlVERnJ3vi09/6+V1qZcUY2EtZo7FUY6+WSvm:RIl1ZzWD609/6+zUYC7K
TLSH
T16754291BF3931CFCD627D17982A6DB71A931B8250364EE6F4994D7331E32C540E6AA38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/5128-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/5128-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4256 set thread context of 5128	4256	2026-08-09_894991138196d7c5a3b1582dbecdfeb1_conti.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 5128	4256	2026-08-09_894991138196d7c5a3b1582dbecdfeb1_conti.exe	90
PID 4256 wrote to memory of 5128	4256	2026-08-09_894991138196d7c5a3b1582dbecdfeb1_conti.exe	90
PID 4256 wrote to memory of 5128	4256	2026-08-09_894991138196d7c5a3b1582dbecdfeb1_conti.exe	90
PID 4256 wrote to memory of 5128	4256	2026-08-09_894991138196d7c5a3b1582dbecdfeb1_conti.exe	90
PID 4256 wrote to memory of 5128	4256	2026-08-09_894991138196d7c5a3b1582dbecdfeb1_conti.exe	90
PID 4256 wrote to memory of 5128	4256	2026-08-09_894991138196d7c5a3b1582dbecdfeb1_conti.exe	90
PID 4256 wrote to memory of 5128	4256	2026-08-09_894991138196d7c5a3b1582dbecdfeb1_conti.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-09_894991138196d7c5a3b1582dbecdfeb1_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_894991138196d7c5a3b1582dbecdfeb1_conti.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_894991138196d7c5a3b1582dbecdfeb1_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-09_894991138196d7c5a3b1582dbecdfeb1_conti.exe"
  2⤵
  PID:5128

memory/4256-0-0x0000000140000000-0x000000014005A000-memory.dmp

Download

memory/4256-3-0x0000000140000000-0x000000014005A000-memory.dmp

Download

memory/5128-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5128-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download