darksiderat | 93d19cac6389e440217ba1661599c483de782500c7be41386d85cad43ce72f34

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 988KB
Sample260812-pykhgscg26
SHA256 93d19cac6389e440217ba1661599c483de782500c7be41386d85cad43ce72f34
MD5 f347ede0608428f1dbf8fa363fb87b0b
SHA1 fcee236e0683c1851d859794892a74b618b2a229
SHA512 be3e66bf34e997b92ac0940a2369af8d07d6cc9c613672ac659dd2e886f95590494fa32dc2f036d54e5f97697edfadc738148bb8c2e7cc3cdd3aa94093c4d5a3
SSDEEP 12288:YWGpvzhondRC0ekoslrH6oGO0vzmElOO0vzmEl:YWGhhq0HkvH6oGFzzOFzz
TLSH
T189255A0AEFB612E5D0BEC039C582612BFD7134A643B0ABD757915A471F36BE4A93E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/4840-8-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1212-6-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1212-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1208 set thread context of 1172	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 1208 set thread context of 1212	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 1208 set thread context of 1984	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	91
PID 1208 set thread context of 4840	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	92

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1172	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 1208 wrote to memory of 1212	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 1208 wrote to memory of 1172	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 1208 wrote to memory of 1172	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 1208 wrote to memory of 1172	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 1208 wrote to memory of 1172	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 1208 wrote to memory of 1172	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 1208 wrote to memory of 1172	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 1208 wrote to memory of 1212	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 1208 wrote to memory of 1212	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 1208 wrote to memory of 1212	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 1208 wrote to memory of 1212	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 1208 wrote to memory of 1212	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 1208 wrote to memory of 1212	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 1208 wrote to memory of 1984	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	91
PID 1208 wrote to memory of 1984	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	91
PID 1208 wrote to memory of 1984	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	91
PID 1208 wrote to memory of 1984	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	91
PID 1208 wrote to memory of 1984	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	91
PID 1208 wrote to memory of 1984	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	91
PID 1208 wrote to memory of 1984	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	91
PID 1208 wrote to memory of 4840	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	92
PID 1208 wrote to memory of 4840	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	92
PID 1208 wrote to memory of 4840	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	92
PID 1208 wrote to memory of 4840	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	92
PID 1208 wrote to memory of 4840	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	92
PID 1208 wrote to memory of 4840	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	92
PID 1208 wrote to memory of 4840	1208	2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:1172
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:1212
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:1984
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_f347ede0608428f1dbf8fa363fb87b0b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:4840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1172-3-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1208-0-0x0000000140000000-0x000000014012F000-memory.dmp

Download

memory/1208-9-0x0000000140000000-0x000000014012F000-memory.dmp

Download

memory/1212-6-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1212-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1984-5-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4840-8-0x0000000140000000-0x0000000140015000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads