darksiderat | 8c5db28e6441bd5c7698337b425d019fc9397335e9983bd178321b6c8cd900c2

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 05:15

Target
2026-08-09_89322dcb05068bbda3b0ad5e7cea4c78_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 444KB
Sample260809-fxrezavsev
SHA256 8c5db28e6441bd5c7698337b425d019fc9397335e9983bd178321b6c8cd900c2
MD5 89322dcb05068bbda3b0ad5e7cea4c78
SHA1 208e780d491bdf59f42fda3698f6c430c7829c47
SHA512 8e36692a95bf3ab6f4a137827a01fea1cabe5e6411bce37adeb2570dd6d1f1a3ffcd2bc271387a97909ae6acf5d04dd36d6697cd47fecb187e08b5ec76c56f35
SSDEEP 3072:foGwD9ytCiumQ7/Tv1uUYML5/Hv3xzPlmBGhDNuUY6+WSvm:gtwbK7/5uUYM1574B6p/
TLSH
T1B7A46B43EB5530E9E1BA42748472CA3A67B6BC311671872F06E87DA77F333815D2AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4712-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4712-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5168 set thread context of 4712	5168	2026-08-09_89322dcb05068bbda3b0ad5e7cea4c78_cobalt-strike_icedid_njrat_satacom_vidar.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5168 wrote to memory of 4712	5168	2026-08-09_89322dcb05068bbda3b0ad5e7cea4c78_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 5168 wrote to memory of 4712	5168	2026-08-09_89322dcb05068bbda3b0ad5e7cea4c78_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 5168 wrote to memory of 4712	5168	2026-08-09_89322dcb05068bbda3b0ad5e7cea4c78_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 5168 wrote to memory of 4712	5168	2026-08-09_89322dcb05068bbda3b0ad5e7cea4c78_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 5168 wrote to memory of 4712	5168	2026-08-09_89322dcb05068bbda3b0ad5e7cea4c78_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 5168 wrote to memory of 4712	5168	2026-08-09_89322dcb05068bbda3b0ad5e7cea4c78_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 5168 wrote to memory of 4712	5168	2026-08-09_89322dcb05068bbda3b0ad5e7cea4c78_cobalt-strike_icedid_njrat_satacom_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_89322dcb05068bbda3b0ad5e7cea4c78_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_89322dcb05068bbda3b0ad5e7cea4c78_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5168
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_89322dcb05068bbda3b0ad5e7cea4c78_cobalt-strike_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-09_89322dcb05068bbda3b0ad5e7cea4c78_cobalt-strike_icedid_njrat_satacom_vidar.exe"
  2⤵
  PID:4712

memory/4712-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4712-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5168-0-0x0000000140000000-0x0000000140080000-memory.dmp

Download

memory/5168-3-0x0000000140000000-0x0000000140080000-memory.dmp

Download