darksiderat | 2c7ced48a042fa2da1efe6656877fd860d2a23501053e2f014dae8e12ae0f0fd

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:56

Target
2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe
Size 2.3MB
Sample260811-eht2wavhla
SHA256 2c7ced48a042fa2da1efe6656877fd860d2a23501053e2f014dae8e12ae0f0fd
MD5 08ff7488dfdb7c864e1a9bb7834ed460
SHA1 d6cd195cc594357b99ac6be5365d0ffcf640f261
SHA512 49cdc6687797432f9a63348b789f07474b2a63cf78542a393997c978d7e79c509065ac5695e7ee5cab8948e2121381baa1147e7e79433e43cceaf62099ddfaa1
SSDEEP 24576:WhI4tB99Uugq+2Idmecx6DViavHCf6QODItoTLd+q7WjUQzW:p439Srq+2IRcx6pZvHW4nsXe
TLSH
T14FB57C27269D019CE0BBE07C8E874B06D7B6B40A03719ADF129045AE2F5BAF55F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/3228-0-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3228-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4832 set thread context of 3228	4832	2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe	89

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3228	4832	2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe	89
PID 4832 wrote to memory of 3228	4832	2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe	89
PID 4832 wrote to memory of 3228	4832	2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe	89
PID 4832 wrote to memory of 3228	4832	2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe	89
PID 4832 wrote to memory of 3228	4832	2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe	89
PID 4832 wrote to memory of 3228	4832	2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe	89
PID 4832 wrote to memory of 3228	4832	2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-11_08ff7488dfdb7c864e1a9bb7834ed460_cobalt-strike_glassworm_icedid_njrat_vidar.exe"
  2⤵
  PID:3228

memory/3228-0-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3228-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download