darksiderat | 6451979f291b7fd608b0f4100ed7e4fa9f57535d6f9a134ea9843304a0959614

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:24

Target
2026-08-09_8a7d9bffeb1cb0acc266352908ff138d_conti.exe
Size 86KB
Sample260809-twqnyavsdw
SHA256 6451979f291b7fd608b0f4100ed7e4fa9f57535d6f9a134ea9843304a0959614
MD5 8a7d9bffeb1cb0acc266352908ff138d
SHA1 f25344d9dd50bfa0e09ab785563f964dfd4621c9
SHA512 6a32e4a9e850875a22ebe3523ab7e7f8c36f60ccae7a5fe91efabc8aa900c33129aa7280c75c065073372c8bf9a7f44e32352ef717fa1149be490dd2da5ebae5
SSDEEP 1536:ZHZjVJ5tCMTcEPmH7GFW9p7AG8Du6+WSss/eYwp:ZHZZp8EPmSI9pUY6+WSvm
TLSH
T1F5838D45EB9318FDC29ED17891E346B3F572BC2142649D7F9240E3361E30E619E2EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/1248-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1248-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3140 set thread context of 1248	3140	2026-08-09_8a7d9bffeb1cb0acc266352908ff138d_conti.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 1248	3140	2026-08-09_8a7d9bffeb1cb0acc266352908ff138d_conti.exe	90
PID 3140 wrote to memory of 1248	3140	2026-08-09_8a7d9bffeb1cb0acc266352908ff138d_conti.exe	90
PID 3140 wrote to memory of 1248	3140	2026-08-09_8a7d9bffeb1cb0acc266352908ff138d_conti.exe	90
PID 3140 wrote to memory of 1248	3140	2026-08-09_8a7d9bffeb1cb0acc266352908ff138d_conti.exe	90
PID 3140 wrote to memory of 1248	3140	2026-08-09_8a7d9bffeb1cb0acc266352908ff138d_conti.exe	90
PID 3140 wrote to memory of 1248	3140	2026-08-09_8a7d9bffeb1cb0acc266352908ff138d_conti.exe	90
PID 3140 wrote to memory of 1248	3140	2026-08-09_8a7d9bffeb1cb0acc266352908ff138d_conti.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-09_8a7d9bffeb1cb0acc266352908ff138d_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8a7d9bffeb1cb0acc266352908ff138d_conti.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_8a7d9bffeb1cb0acc266352908ff138d_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-09_8a7d9bffeb1cb0acc266352908ff138d_conti.exe"
  2⤵
  PID:1248

memory/1248-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1248-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3140-0-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/3140-4-0x0000000140000000-0x0000000140029000-memory.dmp

Download