darksiderat | 72e53986009eaa910120e07700bc687ba6f0207fca84124b4f37744ea627ddf8

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:53

Target
2026-08-09_4a8a93efa65ccb0e2e50226f2d9c64c1_cobalt-strike_icedid_njrat_vidar.exe
Size 2.4MB
Sample260809-vd9jrssbqd
SHA256 72e53986009eaa910120e07700bc687ba6f0207fca84124b4f37744ea627ddf8
MD5 4a8a93efa65ccb0e2e50226f2d9c64c1
SHA1 3a62d6a9f24e61322fd9b4114013c1f4b135c7f0
SHA512 4896f0b945dce4f68ff8814fadf266e311e45da6fa87127ad35d7792e95841809cdb291bb732b10d3dc1a232aced66ca172633f9e2b8eb0199e049e429b969b1
SSDEEP 49152:5umKCy6ZsUmbl5mLBSDf5FA330fsUdp9W4LUmO0GG+WC:rJOB264
TLSH
T1EAB58E17F29A10D8D05ED178CB5A8232EAB17C490B25B5DF0794BA252F37EE45B3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4024-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4024-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3524 set thread context of 4024	3524	2026-08-09_4a8a93efa65ccb0e2e50226f2d9c64c1_cobalt-strike_icedid_njrat_vidar.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4024	3524	2026-08-09_4a8a93efa65ccb0e2e50226f2d9c64c1_cobalt-strike_icedid_njrat_vidar.exe	89
PID 3524 wrote to memory of 4024	3524	2026-08-09_4a8a93efa65ccb0e2e50226f2d9c64c1_cobalt-strike_icedid_njrat_vidar.exe	89
PID 3524 wrote to memory of 4024	3524	2026-08-09_4a8a93efa65ccb0e2e50226f2d9c64c1_cobalt-strike_icedid_njrat_vidar.exe	89
PID 3524 wrote to memory of 4024	3524	2026-08-09_4a8a93efa65ccb0e2e50226f2d9c64c1_cobalt-strike_icedid_njrat_vidar.exe	89
PID 3524 wrote to memory of 4024	3524	2026-08-09_4a8a93efa65ccb0e2e50226f2d9c64c1_cobalt-strike_icedid_njrat_vidar.exe	89
PID 3524 wrote to memory of 4024	3524	2026-08-09_4a8a93efa65ccb0e2e50226f2d9c64c1_cobalt-strike_icedid_njrat_vidar.exe	89
PID 3524 wrote to memory of 4024	3524	2026-08-09_4a8a93efa65ccb0e2e50226f2d9c64c1_cobalt-strike_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_4a8a93efa65ccb0e2e50226f2d9c64c1_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4a8a93efa65ccb0e2e50226f2d9c64c1_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_4a8a93efa65ccb0e2e50226f2d9c64c1_cobalt-strike_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-09_4a8a93efa65ccb0e2e50226f2d9c64c1_cobalt-strike_icedid_njrat_vidar.exe"
  2⤵
  PID:4024

memory/3524-0-0x0000000140000000-0x000000014027F000-memory.dmp

Download

memory/3524-3-0x0000000140000000-0x000000014027F000-memory.dmp

Download

memory/4024-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4024-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download