darksiderat | 3c34973aa5051cf524fa9875d3343258708a26842a9cf4ad0ba3bfb1ccde24d8

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 6.2MB
Sample260820-thcvxstyft
SHA256 3c34973aa5051cf524fa9875d3343258708a26842a9cf4ad0ba3bfb1ccde24d8
MD5 085c1b4b58542142cddd5ca61547f8b9
SHA1 33143bd97c120f13d87a9ab288b71e7ff12866e6
SHA512 78c9bd4a9f952ad0c8b739e9f61a6ec6160aaf4e6e272686c0783885a9573053b4a5da344ad2eb7c8d8588c695034438df406949614611ef79d83c4040a4e09e
SSDEEP 98304:8QiFytO1s/YLceSxJAyJh3ETWvR/2uWujfoTcBqNUK:8zFytO1s/ihSxJAyJh3E5uBO
TLSH
T12056CE276D555453E41DC4BAE392562553B0EF3F2581CAE32040BBB178E23E4FAADF88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4200-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4200-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/memory/4896-4-0x0000000140000000-0x000000014063B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4896 set thread context of 4200	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 4896 set thread context of 6712	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 6712	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 4896 wrote to memory of 6712	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 4896 wrote to memory of 6712	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 4896 wrote to memory of 6712	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 4896 wrote to memory of 6712	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 4896 wrote to memory of 6712	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 4896 wrote to memory of 6712	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 4896 wrote to memory of 4200	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 4896 wrote to memory of 4200	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 4896 wrote to memory of 4200	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 4896 wrote to memory of 4200	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 4896 wrote to memory of 4200	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 4896 wrote to memory of 4200	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 4896 wrote to memory of 4200	4896	2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\Temp\2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
  2⤵
  PID:4200
- C:\Users\Admin\AppData\Local\Temp\2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_085c1b4b58542142cddd5ca61547f8b9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
  2⤵
  PID:6712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4200-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4200-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4896-4-0x0000000140000000-0x000000014063B000-memory.dmp

Download

memory/6712-0-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/6712-3-0x0000000140000000-0x0000000140050000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads