darksiderat | fd95392311e8db30572ddff706f22be306250cda6db64b37a4ec9941bf9800ea

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 16:49

Target
2026-08-12_8ece89dcc205097baeb4d4d87e971531_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 300KB
Sample260812-vb7mdsyyay
SHA256 fd95392311e8db30572ddff706f22be306250cda6db64b37a4ec9941bf9800ea
MD5 8ece89dcc205097baeb4d4d87e971531
SHA1 c2e8042638c182feb4ebd245f6b5b902c57ecedc
SHA512 cdf7d835d8c8e59cc0e44e84d2d8fb5b102beb198690f2afb54741dd3b6288a51c8e6aa481c097311da819840f8cfca8edd9f588a432b3e82009f15851a04e51
SSDEEP 3072:bTbIgVwU1kw2fp24TTcAv+3iyYTw2r3CTWqH5agekGVMjEEVFQyis/OVWLTXaZz2:DIg87fvTIpi/Tvr3XqY/kgRyGWzfOde
TLSH
T127649E5877A108F9FDB7527DC9928547EAB2B8120370DACF03E086661F236E15E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/3652-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3652-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5840 set thread context of 3652	5840	2026-08-12_8ece89dcc205097baeb4d4d87e971531_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5840 wrote to memory of 3652	5840	2026-08-12_8ece89dcc205097baeb4d4d87e971531_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 5840 wrote to memory of 3652	5840	2026-08-12_8ece89dcc205097baeb4d4d87e971531_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 5840 wrote to memory of 3652	5840	2026-08-12_8ece89dcc205097baeb4d4d87e971531_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 5840 wrote to memory of 3652	5840	2026-08-12_8ece89dcc205097baeb4d4d87e971531_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 5840 wrote to memory of 3652	5840	2026-08-12_8ece89dcc205097baeb4d4d87e971531_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 5840 wrote to memory of 3652	5840	2026-08-12_8ece89dcc205097baeb4d4d87e971531_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 5840 wrote to memory of 3652	5840	2026-08-12_8ece89dcc205097baeb4d4d87e971531_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-12_8ece89dcc205097baeb4d4d87e971531_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_8ece89dcc205097baeb4d4d87e971531_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_8ece89dcc205097baeb4d4d87e971531_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_8ece89dcc205097baeb4d4d87e971531_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  PID:3652

memory/3652-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3652-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5840-0-0x0000000140000000-0x0000000140060000-memory.dmp

Download

memory/5840-3-0x0000000140000000-0x0000000140060000-memory.dmp

Download