Overview

overview

10

Static

static

3

2026-08-23...ar.exe

windows10-2004-x64

10

2026-08-23...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 17:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-23_e64cdf45e55c015e7d227c428041f5bc_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
  • Size 11.0MB
  • Sample260823-vsr82aydpf
  • SHA256 59407cf82b1c5195a14ff5b3a18d56a4771d60856cdcd43d64b2a1f4e541607f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
executiondarksiderattrojan

Malware Config

Signatures

  • Family: DarkSideRAT

    DarkSideRAT is a remote access trojan.

    trojandarksiderat
  • Detects DarkSideRAT 3 IoCs
  • Loads dropped DLL 26 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_e64cdf45e55c015e7d227c428041f5bc_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_e64cdf45e55c015e7d227c428041f5bc_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5568
    • C:\Users\Admin\AppData\Local\Temp\2026-08-23_e64cdf45e55c015e7d227c428041f5bc_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_e64cdf45e55c015e7d227c428041f5bc_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
      2⤵
        PID:1200
      • C:\Users\Admin\AppData\Local\Temp\2026-08-23_e64cdf45e55c015e7d227c428041f5bc_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-23_e64cdf45e55c015e7d227c428041f5bc_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1136
        • C:\Users\Admin\AppData\Local\Temp\2026-08-23_e64cdf45e55c015e7d227c428041f5bc_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-08-23_e64cdf45e55c015e7d227c428041f5bc_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
          3⤵
            PID:2004
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c title Kler Cloner - Developed by klerlow
            3⤵
            • Executes a command shell one-liner
            PID:3692
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            3⤵
            • Executes a command shell one-liner
            PID:4092
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            3⤵
            • Executes a command shell one-liner
            PID:2848

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            MSVCP140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\MSVCP140.dll
            • Size 553KB
            • SHA256 9fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\VCRUNTIME140.dll
            • Size 94KB
            • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\VCRUNTIME140_1.dll
            • Size 36KB
            • SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _asyncio.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_asyncio.pyd
            • Size 59KB
            • SHA256 cf0edfd508d11bffb63d1b104b6099e0f14ea0fada762f88364e7163f2185f06
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _brotli.cp310-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_brotli.cp310-win_amd64.pyd
            • Size 861KB
            • SHA256 58bacb135729a70102356c2d110651f1735bf40a602858941e13bdeabfacab4a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_bz2.pyd
            • Size 78KB
            • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _cffi_backend.cp310-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_cffi_backend.cp310-win_amd64.pyd
            • Size 177KB
            • SHA256 2093e7e4f5359b38f0819bdef8314fda332a1427f22e09afc416e1edd5910fe1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_ctypes.pyd
            • Size 117KB
            • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_hashlib.pyd
            • Size 57KB
            • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_lzma.pyd
            • Size 149KB
            • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _overlapped.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_overlapped.pyd
            • Size 44KB
            • SHA256 fe5666c1c8215cd2773744c815fb4a3b2f52f64cf0dde25d458441da22bf5568
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_socket.pyd
            • Size 72KB
            • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_ssl.pyd
            • Size 152KB
            • SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _uuid.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_uuid.pyd
            • Size 20KB
            • SHA256 c74aaeec487457139b47c0ab56e01922bfae6debef562800e5b9b6baf1ec9d6a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\base_library.zip
            • Size 811KB
            • SHA256 3ee15bebac18ce8efc34b3cafd46391940f0241513fa641f45e1df196fd0e5a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\libcrypto-1_1.dll
            • Size 3.3MB
            • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-7.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\libffi-7.dll
            • Size 32KB
            • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\libssl-1_1.dll
            • Size 678KB
            • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _multidict.cp310-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\multidict\_multidict.cp310-win_amd64.pyd
            • Size 45KB
            • SHA256 b7151a6ffa3dc7436d09b1e35343801e11f423c6b391f1177254236ec47a3ad7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _sodium.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\nacl\_sodium.pyd
            • Size 340KB
            • SHA256 d733c23c6a4b21625a4ff07f6562ba882bcbdb0f50826269419d8de0574f88cd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _psutil_windows.cp310-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\psutil\_psutil_windows.cp310-win_amd64.pyd
            • Size 64KB
            • SHA256 a47da972f8440f6713328c5d9e5d805a0fb5d6325e45ed921f0f86c1ca662b59
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\python3.dll
            • Size 60KB
            • SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python310.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\python310.dll
            • Size 4.2MB
            • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\select.pyd
            • Size 25KB
            • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\unicodedata.pyd
            • Size 1.1MB
            • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _quoting_c.cp310-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\yarl\_quoting_c.cp310-win_amd64.pyd
            • Size 78KB
            • SHA256 84c696ed1b5ba6a3819d73b6f27aee93bca72286b32307fe259e23dfc1cfacec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1136-49-0x0000000140000000-0x0000000140B24000-memory.dmp
            Download

            memory/1136-102-0x0000000140000000-0x0000000140B24000-memory.dmp
            Download

            memory/1200-10-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/1200-7-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/2004-59-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/5568-0-0x0000000140000000-0x0000000140B24000-memory.dmp
            Download

            memory/5568-101-0x0000000140000000-0x0000000140B24000-memory.dmp
            Download