darksiderat | 1970e5aa3c16cffdf1669ad6aa5057b4f422b804231851fec24f39d444a53552

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
Size 16.7MB
Sample260827-p6nvwaveld
SHA256 1970e5aa3c16cffdf1669ad6aa5057b4f422b804231851fec24f39d444a53552
MD5 8edad34fdc0e1b0bfad0ca2dd04ff7e1
SHA1 e477ea2b78af9d4a355601659c15842470c25200
SHA512 7cde62196e28407ad54b85d618330783691af4bab85d3e4910a8ad737c8073371b18b8138bdc6b1ea5922b96306a2847b73c9324563615e03e25c21e457cdd7b
SSDEEP 98304:5HhoYabW3Tk5asigKXTwXG9A2+V18Bzt35p+OENp4lt7cQdokZ2XKZ36yUxh+JlV:bRq5zveA58B9yrz4PbdoKQyUxh+/L7p
TLSH
T10C078C43F854D5E4C6EDC170C97A8252BA71B448473D77C72B20AA762B63BC46BBB390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral2/memory/1888-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3304 set thread context of 2788	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	90
PID 3304 set thread context of 1888	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	91
PID 3304 set thread context of 5600	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	92
PID 3304 set thread context of 4632	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	93

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 2788	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	90
PID 3304 wrote to memory of 2788	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	90
PID 3304 wrote to memory of 2788	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	90
PID 3304 wrote to memory of 2788	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	90
PID 3304 wrote to memory of 2788	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	90
PID 3304 wrote to memory of 2788	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	90
PID 3304 wrote to memory of 2788	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	90
PID 3304 wrote to memory of 1888	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	91
PID 3304 wrote to memory of 1888	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	91
PID 3304 wrote to memory of 1888	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	91
PID 3304 wrote to memory of 1888	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	91
PID 3304 wrote to memory of 1888	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	91
PID 3304 wrote to memory of 1888	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	91
PID 3304 wrote to memory of 1888	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	91
PID 3304 wrote to memory of 5600	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	92
PID 3304 wrote to memory of 5600	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	92
PID 3304 wrote to memory of 5600	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	92
PID 3304 wrote to memory of 5600	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	92
PID 3304 wrote to memory of 5600	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	92
PID 3304 wrote to memory of 5600	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	92
PID 3304 wrote to memory of 5600	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	92
PID 3304 wrote to memory of 4632	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	93
PID 3304 wrote to memory of 4632	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	93
PID 3304 wrote to memory of 4632	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	93
PID 3304 wrote to memory of 4632	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	93
PID 3304 wrote to memory of 4632	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	93
PID 3304 wrote to memory of 4632	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	93
PID 3304 wrote to memory of 4632	3304	2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"
  2⤵
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"
  2⤵
  PID:1888
- C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"
  2⤵
  PID:5600
- C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-27_8edad34fdc0e1b0bfad0ca2dd04ff7e1_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"
  2⤵
  PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2788-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3304-0-0x0000000000400000-0x000000000155A000-memory.dmp

Download

memory/3304-6-0x0000000000400000-0x000000000155A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads