darksiderat | ceae812b8e9eb004345ed9220be23428e3792e4cbd839702ee0d580c66ec8063

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 07:05

Target
2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 353KB
Sample260809-hwpk4asgre
SHA256 ceae812b8e9eb004345ed9220be23428e3792e4cbd839702ee0d580c66ec8063
MD5 07aebd83a4b3bfc8bd1a413ff6a419e6
SHA1 c7e040fc67979cb676363a4a550a315ef84e3562
SHA512 f0ff8cd1059a83b7904c06eac4ce46dfb61f15daa1288ea9fb396128a101abe95883ca59611795c0c2a4bded94bb66fba356989b0c1aa29fb51f1bb1f5b1be79
SSDEEP 6144:nemor+ep+ygCo5an+brBsSisTSku03uJH9hJEoha+:JoWbtwsTSksx9hz
TLSH
T1FF747C19F7E510F9E9B7953CCD538546EA727C164760DACF03A08A962F23AD08E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/3264-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3264-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2544 set thread context of 3264	2544	2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 3264	2544	2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 2544 wrote to memory of 3264	2544	2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 2544 wrote to memory of 3264	2544	2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 2544 wrote to memory of 3264	2544	2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 2544 wrote to memory of 3264	2544	2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 2544 wrote to memory of 3264	2544	2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 2544 wrote to memory of 3264	2544	2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:3264

memory/2544-0-0x0000000140000000-0x000000014006A000-memory.dmp

Download

memory/2544-3-0x0000000140000000-0x000000014006A000-memory.dmp

Download

memory/3264-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3264-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download