darksiderat | dfacc25fbf9d13d7cc45cc2428e31609df7cf42b9818b1863e0aaaf85849e976

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 09:20

Target
loader.vmp.exe
Size 25.5MB
Sample260822-la7rbsxtew
SHA256 dfacc25fbf9d13d7cc45cc2428e31609df7cf42b9818b1863e0aaaf85849e976
MD5 e4207e8425a57a0e459e177567582ff9
SHA1 2c1411e2b6e7338d9395024540d831f72c119d76
SHA512 fd8f187439ad24f1885d8df761979480eaf8b1947a1c1d26627d2af5870d86b9c9f306439676eb98d27a9cba726f1487e2f6e2f05bb7d1808d980518592876a8
SSDEEP 393216:Iz32WSteb6F/SGdUBPVvU/51sOcXSsvUypCtb6xg/8/yC94N5heU:WEwbSaye181/3mK6SUaC9yhT
TLSH
T1714723D269D692E4E3D34F08D2CB13879390B2D9D596861E35C6AC032931EA78F46D3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4708-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4708-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4732	loader.vmp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4732 set thread context of 4708	4732	loader.vmp.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4708	4732	loader.vmp.exe	90
PID 4732 wrote to memory of 4708	4732	loader.vmp.exe	90
PID 4732 wrote to memory of 4708	4732	loader.vmp.exe	90
PID 4732 wrote to memory of 4708	4732	loader.vmp.exe	90
PID 4732 wrote to memory of 4708	4732	loader.vmp.exe	90
PID 4732 wrote to memory of 4708	4732	loader.vmp.exe	90
PID 4732 wrote to memory of 4708	4732	loader.vmp.exe	90

C:\Users\Admin\AppData\Local\Temp\loader.vmp.exe
"C:\Users\Admin\AppData\Local\Temp\loader.vmp.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\loader.vmp.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.vmp.exe"
  2⤵
  PID:4708

memory/4708-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4708-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4732-0-0x0000000140000000-0x000000014297F000-memory.dmp

Download

memory/4732-3-0x0000000140000000-0x000000014297F000-memory.dmp

Download