darksiderat | a3f0b6e6d86266047eddd29915dda84b8e641f5b777415ac95943ffd4d4be301

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 02:41

Target
2026-08-27_ed641240f91a72b36d75a55c21dfb95d_conti.exe
Size 179KB
Sample260828-c6matsbf53
SHA256 a3f0b6e6d86266047eddd29915dda84b8e641f5b777415ac95943ffd4d4be301
MD5 ed641240f91a72b36d75a55c21dfb95d
SHA1 89bb0be72826ea90d1984845fe778b5b9572e4bc
SHA512 2ca6cee0c432a8b10cd43717c2b0e07cd8d5daf8bb16be9f29d6af3bf5bc8c913482ecda197db51b5360c8314e55926e28eb747666fcf0c08e884f55f090a934
SSDEEP 3072:WKkA2frVkwxUXA9AhhmXXX8XGYCLa5Uwsl8z6AvUY6+WSvm:+x9fX7YC4X6A4
TLSH
T1EF04AF38EBA368FDC16F82B495939AB3F5327D110364AA7F2765E2775C30E80893E015
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/3816-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3816-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3244 set thread context of 3816	3244	2026-08-27_ed641240f91a72b36d75a55c21dfb95d_conti.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 3816	3244	2026-08-27_ed641240f91a72b36d75a55c21dfb95d_conti.exe	90
PID 3244 wrote to memory of 3816	3244	2026-08-27_ed641240f91a72b36d75a55c21dfb95d_conti.exe	90
PID 3244 wrote to memory of 3816	3244	2026-08-27_ed641240f91a72b36d75a55c21dfb95d_conti.exe	90
PID 3244 wrote to memory of 3816	3244	2026-08-27_ed641240f91a72b36d75a55c21dfb95d_conti.exe	90
PID 3244 wrote to memory of 3816	3244	2026-08-27_ed641240f91a72b36d75a55c21dfb95d_conti.exe	90
PID 3244 wrote to memory of 3816	3244	2026-08-27_ed641240f91a72b36d75a55c21dfb95d_conti.exe	90
PID 3244 wrote to memory of 3816	3244	2026-08-27_ed641240f91a72b36d75a55c21dfb95d_conti.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-27_ed641240f91a72b36d75a55c21dfb95d_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_ed641240f91a72b36d75a55c21dfb95d_conti.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Users\Admin\AppData\Local\Temp\2026-08-27_ed641240f91a72b36d75a55c21dfb95d_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-27_ed641240f91a72b36d75a55c21dfb95d_conti.exe"
  2⤵
  PID:3816

memory/3244-0-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/3244-4-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/3816-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3816-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download