darksiderat | 7f84255996a11a4034e80017b05fda810f2948e51cde543865820e6cebac1f5b

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 16:07

Target
2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar.exe
Size 2.7MB
Sample260812-tk28la1amb
SHA256 7f84255996a11a4034e80017b05fda810f2948e51cde543865820e6cebac1f5b
MD5 0c3d8f0408cb0e947211b3aecfe25e4a
SHA1 d3b8f2f3f029868ff46dba9461da1a7c73c726a4
SHA512 1ae679ac4a73cf5c9d9b77f90e4f8f50f2bc8dc37563ed50c384f26115cd8cb85e30f16bc92865fc7a42aa71cfaad555a8325005b2b003dfe11b30d6f6006e7e
SSDEEP 49152:yxePOqbEc9zkUQIz+r3OvjgA0Xb8hNvVVdD3vOMmDDuAMBg65d:NEykvXivfuuAszd
TLSH
T1FDD5AD43F25601E9C07BD034C99A9717F774B80903209AFB87E499656F53AE0AF7B392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/2760-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2760-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6020 set thread context of 2760	6020	2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 2760	6020	2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar.exe	90
PID 6020 wrote to memory of 2760	6020	2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar.exe	90
PID 6020 wrote to memory of 2760	6020	2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar.exe	90
PID 6020 wrote to memory of 2760	6020	2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar.exe	90
PID 6020 wrote to memory of 2760	6020	2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar.exe	90
PID 6020 wrote to memory of 2760	6020	2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar.exe	90
PID 6020 wrote to memory of 2760	6020	2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar.exe"
  2⤵
  PID:2760

memory/2760-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2760-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/6020-0-0x0000000140000000-0x000000014030D000-memory.dmp

Download

memory/6020-3-0x0000000140000000-0x000000014030D000-memory.dmp

Download