darksiderat | b5d949fefaa03c73fc246a99e6d193c7520e7e1d2f25158acaa7350640e97d2f

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f3f0297f482d1b22a00595c43b104dc7_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 532KB
Sample260819-plkbystfph
SHA256 b5d949fefaa03c73fc246a99e6d193c7520e7e1d2f25158acaa7350640e97d2f
MD5 f3f0297f482d1b22a00595c43b104dc7
SHA1 c038a1231955f9c275d6f3d6562ee5a6d2f23005
SHA512 8608e911099187c8705b1481b1c1de12eab94ed8bf3d41520cfb7ef37a52dc7ad99cd20f1a4adea1083cea74b15b5dac27e1e3c72dc4322175d00bd93b7648bb
SSDEEP 6144:99yTq1qdhmi+imwlnKCGe22xuUT/xrsw8uUiR9XU1hI3:/V1i+ARKCsmuUT/xQw/XU
TLSH
T10EC48E25EBA510FDE177D5B8C9624D02DB72BC8A0361AACF23904DA21F176D49F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c40d-18.dat	family_darksiderat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	4220	2026-08-19_f3f0297f482d1b22a00595c43b104dc7_cobalt-strike_icedid_njrat_satacom_stealc.exe

Executes dropped EXE 1 IoCs

pid	Process
5112	ox_1787142388899.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5916	icacls.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 5952	4220	2026-08-19_f3f0297f482d1b22a00595c43b104dc7_cobalt-strike_icedid_njrat_satacom_stealc.exe	91
PID 5952 wrote to memory of 5112	5952	cmd.exe	93
PID 5112 wrote to memory of 5916	5112	ox_1787142388899.exe	94
PID 5112 wrote to memory of 5916	5112	ox_1787142388899.exe	94
PID 5112 wrote to memory of 5916	5112	ox_1787142388899.exe	94
PID 5112 wrote to memory of 5916	5112	ox_1787142388899.exe	94
PID 5112 wrote to memory of 5916	5112	ox_1787142388899.exe	94
PID 5112 wrote to memory of 5916	5112	ox_1787142388899.exe	94
PID 5112 wrote to memory of 5916	5112	ox_1787142388899.exe	94
PID 5112 wrote to memory of 5916	5112	ox_1787142388899.exe	94
PID 5112 wrote to memory of 5916	5112	ox_1787142388899.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f3f0297f482d1b22a00595c43b104dc7_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f3f0297f482d1b22a00595c43b104dc7_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1787142388899.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Users\Admin\AppData\Local\Temp\ox_1787142388899.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1787142388899.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe"
      4⤵
      Modifies file permissions
      PID:5916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ox_1787142388899.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1787142388899.exe
Size 56KB
SHA256 0d0a91c58d930d76a2600f1b75965a4edfb63357284c5965fb3b3f08266f0237
MD5 68ddf5f041cc9d80252e243352728396
SHA1 fb5c316bd6f4411aec73516adb311624e707d83b
SHA512 9f9a0bc1bc25f6eea49ed3f9a9e0025562ff6865e06d6c08917b182c8017aa3afecd23ea4a622e713a0430909b8dd992d0a9b33e97c8e4e7b8edba16f7c3463c
SSDEEP 768:Eb9OnCKoatcLZBTjwFrECxGazpOWp54vg5d5YP98yxA1XbXP7kW7rCVr8Z0kP:I9vatZ5tsWp0g5rBSmLYW7rCVoekP
TLSH
T13043F834EA5AB06FD35ED834DD430D16CD12BCCA97A0BB9B57915CD20EAAF209B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4220-0-0x0000000140000000-0x0000000140085000-memory.dmp

Download

memory/4220-1-0x0000000140000000-0x0000000140085000-memory.dmp

Download

memory/5916-46-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-39-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-49-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-51-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-52-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-41-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-47-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-27-0x00000201161E0000-0x00000201161E1000-memory.dmp

Download

memory/5916-42-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-26-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-50-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-45-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-43-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-44-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-40-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-38-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-33-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

memory/5916-48-0x0000020115AC0000-0x00000201161D9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads