darksiderat | 460b81140564590888abee548709c922cfe59acc7441ab07d3c7f987968af0a7

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 8.6MB
Sample260824-wn9sysar7z
SHA256 460b81140564590888abee548709c922cfe59acc7441ab07d3c7f987968af0a7
MD5 04517aca341996fbec901b5c8072f60c
SHA1 a0781a82ea01acaa892199727da029bd219de8cd
SHA512 0142ac3f8a79a78eb89e9d8bbc883cd340fefc6911ded3d444c45ed99d99d6192822df094d8f75180e3b891a29443e1e7c216eafb6d14bbc5d30779864edf265
SSDEEP 196608:+0+BILXEpXnH2ph1igtlxSiLCw10+u41ZPcUcdtytvonYpPT11pZ:0SLXEAphJtD510MjAytvUYD
TLSH
T152963368BB9411FAE4B7403D9996D862A3F275031B92D3D727B055263F336F05E3CAA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/3240-10-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3240-11-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1228-24-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Loads dropped DLL 5 IoCs

pid	Process
1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4852 set thread context of 3240	4852	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 1780 set thread context of 1228	1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3240	4852	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4852 wrote to memory of 3240	4852	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4852 wrote to memory of 3240	4852	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4852 wrote to memory of 3240	4852	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4852 wrote to memory of 3240	4852	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4852 wrote to memory of 3240	4852	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4852 wrote to memory of 3240	4852	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4852 wrote to memory of 1780	4852	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 1780 wrote to memory of 1228	1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 1780 wrote to memory of 1228	1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 1780 wrote to memory of 1228	1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 1780 wrote to memory of 1228	1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 1780 wrote to memory of 1228	1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 1780 wrote to memory of 1228	1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 1780 wrote to memory of 1228	1780	2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  PID:3240
- C:\Users\Admin\AppData\Local\Temp\2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Users\Admin\AppData\Local\Temp\2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_04517aca341996fbec901b5c8072f60c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    3⤵
    PID:1228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\_bz2.pyd
Size 86KB
SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
MD5 4cc74cced07914bd71dc9c4d2a3f127a
SHA1 77bda774eff7c8afc94892d2d5d63dd3c80f9ea4
SHA512 8f81a5287bc5f59eeb6bb6703c00495cf761816e6eb20b6cb401af20040464fffc5b5e95d21b49d6260debb9cfac4031cf87b5248c0077fa8edd0d390cc1910b
SSDEEP 1536:+/BvOKz7hvAKyRXzgwnZpfzyONpGX/4TjW8hSlUbrjvUIp3VJyPs5i9EfIY+8i:YBvLztGRXHyONpE/ajhwYXUIp3VGV
TLSH
T185838E87E3A463F6F6AB81B4D6810753E730BB460750A3AFB24482853F23F91AE59355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\_lzma.pyd
Size 157KB
SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
MD5 e882005d06af06ef17b2338342b3f41e
SHA1 96dfac53ce267a9dd4d094bf5c5a665bc1cedfe9
SHA512 1e53c3501796da814f75ba8fc683720e968c5944fbeb2b9836c48a6656df0da120c075bc6c17ea788efa14be11f29172e80c64febe72e43502a02f707a5928dd
SSDEEP 3072:NJ66g4T5QW7JfyjEqkSkA51b4rznfJ9mNoVUIsbUIpI1yUx1:NUR4Tp4QPZ8N4nxYOIbHy
TLSH
T1FDF34C86B794F0E6F7328C78D2614F57E6F5781A0320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\_zstd.pyd
Size 491KB
SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
MD5 fee9e34fa16e0ff378c281202a78d003
SHA1 d8681b1ecf3776d1f095ecb738210423bcfec287
SHA512 766fa08c57cb9e000237a5690e6bae8fbe2d2fb79fdf39f1a2f07ec668ee225df9675c9041d4b26410cbb4fb341693454dbcad722bcff3e78321412e0bfcf4ae
SSDEEP 6144:HoRvcMPHwrJqB2l1eUVcXmgqCBdBwzKhThruVxzeeVUL2LzMYZpzBYQFE95+SClu:IRFcemgqKP2eeVC2Lz9kQe95BCl9Vmxp
TLSH
T1C2B48D43F29943EDE53BC4B8CF465A13FBB1780B1214965B97A5CB993F07B309A69308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\base_library.zip
Size 1.3MB
SHA256 8ba56678ec33c4a8991dce19816b04057c6905f2529bf47ba290167fc4829999
MD5 834f4be9c5b505a9a3b0ff60a84f79a1
SHA1 ac9a5869c9e3da3a3fa086b4ba79134fa5c8be9d
SHA512 d6178172105d4ed855d337c71665bb272f70d1684df7a0b06627e8eec6ee407d1f381b21cd492790ec907edfe4090048b64ed0f4ed0b7923da4f3675fe4990d9
SSDEEP 24576:60NuUF3LKQeOdP2m2dfI3Y5lbK6RZUDZSdjU:puUFG/EYpRyUdg
TLSH
T11D552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f42\python314.dll
Size 6.5MB
SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
MD5 689a9724a63fb3b4f209c771c31d8a05
SHA1 2f88e8e16a9086e7974da71914fe4e89cd2eff9a
SHA512 0c96ec1b9ef6e56f29202681272c1062ea49867757c966ebdd050c513d4988cfab7cd6c31e1d94f438c1412b38f7b446af1629b2776c41d712051ab70054ac9f
SSDEEP 98304:xEQucV/qdDSSmJBA3ICXmRaJtv3vyHDMiE4rofB:xEQucVygSmJBA3InSiFG
TLSH
T19F668D26737515A4D8BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-24-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1780-18-0x0000000140000000-0x00000001408A4000-memory.dmp

Download

memory/1780-32-0x0000000140000000-0x00000001408A4000-memory.dmp

Download

memory/3240-11-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3240-10-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4852-0-0x0000000140000000-0x00000001408A4000-memory.dmp

Download

memory/4852-31-0x0000000140000000-0x00000001408A4000-memory.dmp

Download