darksiderat | dec6ad0dbe906620edb61d5d2eaf90e2d851e91ad3510050419c386ee4b0d939

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 04:24

Target
2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 293KB
Sample260828-e1g52aep9z
SHA256 dec6ad0dbe906620edb61d5d2eaf90e2d851e91ad3510050419c386ee4b0d939
MD5 de83a50e1af985354eb1294abdcb7eba
SHA1 55e82a4cfd9fde5ea81d8186f3343829b413fc91
SHA512 b663c0028526f98af458a7d1a371b1e89c2af593a27ef19aa683d87921e2c123588c14c11620e20262b96a6db2a66af6aa86c7407afd1db1cd2f0935c76a22f6
SSDEEP 3072:G6J95zEieTNPkSSaJiCfqKeNF87+X5XI2Hmfr49WFk4buAs0FNmhMn+IhNn/gS68:vtvEcSSpJKGFdXOsW+1YlR
TLSH
T1D0544A06B79A01E5D0B68174877747E2AB3D7C214791C68F07D47B66EE3E2C0BD2A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/3948-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3948-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4700 set thread context of 3948	4700	2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 3948	4700	2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat.exe	90
PID 4700 wrote to memory of 3948	4700	2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat.exe	90
PID 4700 wrote to memory of 3948	4700	2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat.exe	90
PID 4700 wrote to memory of 3948	4700	2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat.exe	90
PID 4700 wrote to memory of 3948	4700	2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat.exe	90
PID 4700 wrote to memory of 3948	4700	2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat.exe	90
PID 4700 wrote to memory of 3948	4700	2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\Temp\2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat.exe"
  2⤵
  PID:3948

memory/3948-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3948-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4700-0-0x0000000140000000-0x0000000140076000-memory.dmp

Download

memory/4700-3-0x0000000140000000-0x0000000140076000-memory.dmp

Download