darksiderat | ad5411e341a2c51841d8af3f8791d473fde26025a6bc77e9aa66c95522027fad

Analysis

user interaction
yes
max time kernel
898s
max time network
462s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 01:41

Target
Process.exe
Size 1.1MB
Sample260822-b4actaem5s
SHA256 ad5411e341a2c51841d8af3f8791d473fde26025a6bc77e9aa66c95522027fad
MD5 5c79ec9f0451d4e1eb87ed8c692f0d05
SHA1 96b891cee0c5df5d3ec7c56d2a5bc37681f8e208
SHA512 2cd450d89e92f33ea4625b623e8204efbcae199b04c075967af22e64f4b5e36763e3d88ae65bebe9a9df4597551ac49b454a541ed3780726e22453200384e69e
SSDEEP 24576:to6KfmwcUApLvpZvlcRY9lhh5TAenQkpv:66KuwFAHZvmRY9lhhH
TLSH
T1FB453A47E26395ECC66BC07487539772FA30B4590234BE6E1A99D7321F32E509B2EB34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/932-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/932-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2992 set thread context of 932	2992	Process.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 932	2992	Process.exe	90
PID 2992 wrote to memory of 932	2992	Process.exe	90
PID 2992 wrote to memory of 932	2992	Process.exe	90
PID 2992 wrote to memory of 932	2992	Process.exe	90
PID 2992 wrote to memory of 932	2992	Process.exe	90
PID 2992 wrote to memory of 932	2992	Process.exe	90
PID 2992 wrote to memory of 932	2992	Process.exe	90

C:\Users\Admin\AppData\Local\Temp\Process.exe
"C:\Users\Admin\AppData\Local\Temp\Process.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\Process.exe
  "C:\Users\Admin\AppData\Local\Temp\Process.exe"
  2⤵
  PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2200

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:552

memory/932-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/932-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2992-0-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2992-3-0x0000000140000000-0x0000000140136000-memory.dmp

Download