darksiderat | 6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 18:29

Target
6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626.exe
Size 1007KB
Sample260826-w5a1ysvbmd
SHA256 6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626
MD5 e7e88753f89bd42e91df2e79d2b8839f
SHA1 9a00a45a2e62fad023c3b5d2b7397a063e41c790
SHA512 8a5c0f2c7e8dc072e50f630c51cd9ab14768af94659067d017cd6b01ffe47ca88c983bde0fa63c15839282fd13e00f29f92845ac073d2dfdd9bc2a0fc51a8226
SSDEEP 24576:JsG4r8Jo3sfwSnrbIZH7wNKD5ySFZP+uh08:Jw8Jo3kwHZHlkSr+Q0
TLSH
T13B25CF51A69804FCE1BBA27C89624906E73A7C1A4770DBCF1394D17A2F726D09F39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 4 IoCs

resource	yara_rule
behavioral1/memory/1808-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1808-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1808-3-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1808-4-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3564 set thread context of 1808	3564	6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626.exe	85

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 1808	3564	6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626.exe	85
PID 3564 wrote to memory of 1808	3564	6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626.exe	85
PID 3564 wrote to memory of 1808	3564	6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626.exe	85
PID 3564 wrote to memory of 1808	3564	6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626.exe	85
PID 3564 wrote to memory of 1808	3564	6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626.exe	85
PID 3564 wrote to memory of 1808	3564	6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626.exe	85
PID 3564 wrote to memory of 1808	3564	6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626.exe	85

C:\Users\Admin\AppData\Local\Temp\6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626.exe
"C:\Users\Admin\AppData\Local\Temp\6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626.exe
  "C:\Users\Admin\AppData\Local\Temp\6c732594b25e5aa4d6189a876ef08dc03ff14c46d7e4c5186c915ec0cce2f626.exe"
  2⤵
  PID:1808

memory/1808-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1808-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1808-3-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1808-4-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3564-0-0x0000000140000000-0x000000014010E000-memory.dmp

Download

memory/3564-5-0x0000000140000000-0x000000014010E000-memory.dmp

Download