darksiderat | 3a8bcbf4650676d05fb32dec8a799d66cd9abdadbc23db7796336efa1120d56a

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 23:43

Target
2026-08-16_2de2a1c5f00fa87ab7d5a04444ea3d3b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 6.2MB
Sample260816-3qlbpszvay
SHA256 3a8bcbf4650676d05fb32dec8a799d66cd9abdadbc23db7796336efa1120d56a
MD5 2de2a1c5f00fa87ab7d5a04444ea3d3b
SHA1 b68d10047c6470a22b38c1e9ec8b3dbba41b4d52
SHA512 e999869c35369fd6f4f591e61f3529c9f768e6694597a3549e170059f6f030f5295e7e54d4eb9e9ba00c71c5b4427397a4449cf4107b71afb0926b98966f8bf5
SSDEEP 98304:ZQiFytO1s/YLceSxJAyJh3ETWvR/2uWujfoTcBqNUK:ZzFytO1s/ihSxJAyJh3E5uBO
TLSH
T12856CE276D555453E41DC4BAE392562153B0EF3F2581CAE72040BBB178E23E4FAADF88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4500-0-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4500-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Detects executables referencing many IR and analysis tools 2 IoCs

resource	yara_rule
behavioral2/memory/4808-1-0x0000000140000000-0x0000000140635000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4808-3-0x0000000140000000-0x0000000140635000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4808 set thread context of 4500	4808	2026-08-16_2de2a1c5f00fa87ab7d5a04444ea3d3b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4500	4808	2026-08-16_2de2a1c5f00fa87ab7d5a04444ea3d3b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 4808 wrote to memory of 4500	4808	2026-08-16_2de2a1c5f00fa87ab7d5a04444ea3d3b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 4808 wrote to memory of 4500	4808	2026-08-16_2de2a1c5f00fa87ab7d5a04444ea3d3b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 4808 wrote to memory of 4500	4808	2026-08-16_2de2a1c5f00fa87ab7d5a04444ea3d3b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 4808 wrote to memory of 4500	4808	2026-08-16_2de2a1c5f00fa87ab7d5a04444ea3d3b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 4808 wrote to memory of 4500	4808	2026-08-16_2de2a1c5f00fa87ab7d5a04444ea3d3b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 4808 wrote to memory of 4500	4808	2026-08-16_2de2a1c5f00fa87ab7d5a04444ea3d3b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-16_2de2a1c5f00fa87ab7d5a04444ea3d3b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_2de2a1c5f00fa87ab7d5a04444ea3d3b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_2de2a1c5f00fa87ab7d5a04444ea3d3b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_2de2a1c5f00fa87ab7d5a04444ea3d3b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
  2⤵
  PID:4500

memory/4500-0-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4500-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4808-1-0x0000000140000000-0x0000000140635000-memory.dmp

Download

memory/4808-3-0x0000000140000000-0x0000000140635000-memory.dmp

Download