Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
25/08/2026, 01:28
General
- Target 2026-08-24_c7e5ca1d8a422db9d3c300ad8b40ab17_cobalt-strike_icedid_satacom_stealc.exe
- Size 283KB
- Sample260825-bvmxjsff39
- SHA256 19a95153b27ed3d515ebbff37de4554eb486f9f692bc4ebb35bc072591b735cb
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Modifies registry class 5 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_c7e5ca1d8a422db9d3c300ad8b40ab17_cobalt-strike_icedid_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_c7e5ca1d8a422db9d3c300ad8b40ab17_cobalt-strike_icedid_satacom_stealc.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_c7e5ca1d8a422db9d3c300ad8b40ab17_cobalt-strike_icedid_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_c7e5ca1d8a422db9d3c300ad8b40ab17_cobalt-strike_icedid_satacom_stealc.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4128-1-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4128-3-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4128-4-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4128-2-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4132-0-0x0000000140000000-0x000000014005A000-memory.dmp
memory/4132-5-0x0000000140000000-0x000000014005A000-memory.dmp