Overview

overview

10

Static

static

3

2026-08-24...ar.exe

windows10-2004-x64

10

2026-08-24...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 22:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-24_dc331fa4f5fbf9cd5afa2e63f03de29f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 5.4MB
  • Sample260824-2vdxravclc
  • SHA256 4fbbfd0b0ef534fe6151b5ea5a0e19131dd4924fb403306e2c15f194462c308c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
executiondarksiderattrojan

Malware Config

Signatures

  • Family: DarkSideRAT

    DarkSideRAT is a remote access trojan.

    trojandarksiderat
  • Detects DarkSideRAT 3 IoCs
  • Loads dropped DLL 11 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_dc331fa4f5fbf9cd5afa2e63f03de29f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-24_dc331fa4f5fbf9cd5afa2e63f03de29f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3380
    • C:\Users\Admin\AppData\Local\Temp\2026-08-24_dc331fa4f5fbf9cd5afa2e63f03de29f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-24_dc331fa4f5fbf9cd5afa2e63f03de29f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
        PID:3176
      • C:\Users\Admin\AppData\Local\Temp\2026-08-24_dc331fa4f5fbf9cd5afa2e63f03de29f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-24_dc331fa4f5fbf9cd5afa2e63f03de29f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5468
        • C:\Users\Admin\AppData\Local\Temp\2026-08-24_dc331fa4f5fbf9cd5afa2e63f03de29f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-08-24_dc331fa4f5fbf9cd5afa2e63f03de29f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
          3⤵
            PID:3488
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c title Asteroid Injector
            3⤵
            • Executes a command shell one-liner
            PID:4144

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\VCRUNTIME140.dll
            • Size 94KB
            • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_bz2.pyd
            • Size 78KB
            • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_ctypes.pyd
            • Size 117KB
            • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _decimal.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_decimal.pyd
            • Size 241KB
            • SHA256 384993b2b8cfcbf155e63f0ee2383a9f9483de92ab73736ff84590a0c4ca2690
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_hashlib.pyd
            • Size 57KB
            • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_lzma.pyd
            • Size 149KB
            • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_socket.pyd
            • Size 72KB
            • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\base_library.zip
            • Size 858KB
            • SHA256 feec7e6929e9c537f43f3e95949c1241c3905a95df1d56815fda7b1adbc63eb4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\libcrypto-1_1.dll
            • Size 3.3MB
            • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-7.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\libffi-7.dll
            • Size 32KB
            • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _psutil_windows.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\psutil\_psutil_windows.pyd
            • Size 65KB
            • SHA256 e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            injector.cp310-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\pyinjector\injector.cp310-win_amd64.pyd
            • Size 20KB
            • SHA256 10575c0fe3fa9dabeddb0f65beb38e3d99081245de46c6770994ed28dbba397e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.DLL
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\python3.DLL
            • Size 60KB
            • SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python310.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\python310.dll
            • Size 4.2MB
            • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\select.pyd
            • Size 25KB
            • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\unicodedata.pyd
            • Size 1.1MB
            • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3176-10-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/3176-8-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/3380-0-0x0000000140000000-0x0000000140586000-memory.dmp
            Download

            memory/3380-49-0x0000000140000000-0x0000000140586000-memory.dmp
            Download

            memory/3488-26-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/5468-20-0x0000000140000000-0x0000000140586000-memory.dmp
            Download

            memory/5468-50-0x0000000140000000-0x0000000140586000-memory.dmp
            Download