darksiderat | fc93207e1c2708e223cffb11a90d4e8430e279d5fc5bb29678208205b380fcb4

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 05:43

Target
2026-08-11_33108e0474284d3aaf927f0465974c0e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 796KB
Sample260811-getcaagr7t
SHA256 fc93207e1c2708e223cffb11a90d4e8430e279d5fc5bb29678208205b380fcb4
MD5 33108e0474284d3aaf927f0465974c0e
SHA1 8752683664c7871c8c9f1ed1474e9702f77be3fa
SHA512 1b8927aea8c4df98ad1eb8ffe41a2fc1c27c9c271148e66b0ba0cc96a87cc4c3c5b86d71dff096e199a952432da24e45c7e2192630e6a1d5664dd021f999c511
SSDEEP 24576:mnzFFA0rqxjD6BA2OkZsD3LE+bUHhkcPVRFR6k7jrYcQh:YzFFA0rqx6BA2OkZsD3LE+bUHhkcPVLv
TLSH
T15605386AB7A410E4D17AD17D86628966D5F279929371D9CF03A483623F23FF8187F320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/5780-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/5780-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5736 set thread context of 5780	5736	2026-08-11_33108e0474284d3aaf927f0465974c0e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5736 wrote to memory of 5780	5736	2026-08-11_33108e0474284d3aaf927f0465974c0e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 5736 wrote to memory of 5780	5736	2026-08-11_33108e0474284d3aaf927f0465974c0e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 5736 wrote to memory of 5780	5736	2026-08-11_33108e0474284d3aaf927f0465974c0e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 5736 wrote to memory of 5780	5736	2026-08-11_33108e0474284d3aaf927f0465974c0e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 5736 wrote to memory of 5780	5736	2026-08-11_33108e0474284d3aaf927f0465974c0e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 5736 wrote to memory of 5780	5736	2026-08-11_33108e0474284d3aaf927f0465974c0e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 5736 wrote to memory of 5780	5736	2026-08-11_33108e0474284d3aaf927f0465974c0e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-11_33108e0474284d3aaf927f0465974c0e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_33108e0474284d3aaf927f0465974c0e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5736
- C:\Users\Admin\AppData\Local\Temp\2026-08-11_33108e0474284d3aaf927f0465974c0e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-11_33108e0474284d3aaf927f0465974c0e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:5780

memory/5736-0-0x0000000140000000-0x00000001400D8000-memory.dmp

Download

memory/5736-3-0x0000000140000000-0x00000001400D8000-memory.dmp

Download

memory/5780-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5780-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download