Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/08/2026, 12:56
General
- Target 2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
- Size 16.7MB
- Sample260827-p6nvwaveld
- SHA256 1970e5aa3c16cffdf1669ad6aa5057b4f422b804231851fec24f39d444a53552
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 7 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵
- Suspicious use of UnmapMainImage
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1808-0-0x0000000000400000-0x000000000155A000-memory.dmp
memory/1808-21-0x0000000000400000-0x000000000155A000-memory.dmp
memory/2096-17-0x0000000140000000-0x0000000140015000-memory.dmp
memory/2096-16-0x0000000140000000-0x0000000140015000-memory.dmp
memory/2096-19-0x0000000140000000-0x0000000140015000-memory.dmp
memory/2500-9-0x0000000140000000-0x0000000140015000-memory.dmp
memory/2500-7-0x0000000140000000-0x0000000140015000-memory.dmp
memory/2500-6-0x0000000140000000-0x0000000140015000-memory.dmp
memory/2500-5-0x0000000140000000-0x0000000140015000-memory.dmp
memory/2996-12-0x0000000140000000-0x0000000140050000-memory.dmp
memory/2996-14-0x0000000140000000-0x0000000140050000-memory.dmp
memory/2996-11-0x0000000140000000-0x0000000140050000-memory.dmp
memory/3368-1-0x0000000140000000-0x0000000140050000-memory.dmp
memory/3368-4-0x0000000140000000-0x0000000140050000-memory.dmp
memory/3368-3-0x0000000140000000-0x0000000140050000-memory.dmp
memory/3368-2-0x0000000140000000-0x0000000140050000-memory.dmp