darksiderat | 6a5145e48e476e2ed6568b8da54bc66e4d29d798c8b69ee81336fe7fcd45a548

Resubmissions

11/09/2026, 20:01

260911-yrtx1scc3310

11/09/2026, 12:42

260911-pxh82awtgv10

Analysis

max time kernel
900s
max time network
569s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/09/2026, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 63.1MB
Sample260911-yrtx1scc33
SHA256 6a5145e48e476e2ed6568b8da54bc66e4d29d798c8b69ee81336fe7fcd45a548
MD5 ba145d4d7fcb5eb0c8111346c815bfc1
SHA1 81f337a3207f7bcca6070e230fb0adf38ea5036e
SHA512 c57f40c383d58e0a0bc6ab4d447d6dbb377adf5477928c15d554b56f27fe2740a9b5a1b149f0d26f185f36fbf6c0b4d87561ff6c6f8c93b62d9a2989bd9c7dcd
SSDEEP 786432:dHLd7dsuhPKqXvDamTQeMImEO0wvyP2wEZgO7k6:9LMuzbEJ/EOBvyP21L
TLSH
T1F0E78D07F29750D8D069D1749BDB9A22F572BC854F30ABEF22445B262F72BD01B7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 32 IoCs

resource	yara_rule
behavioral2/memory/4992-47-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4884-59-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1948-62-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2276-64-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3800-81-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4992-76-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2448-68-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4884-57-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4884-55-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2232-53-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2276-52-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2448-50-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1796-49-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3800-45-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1948-43-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2276-37-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2276-36-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2448-32-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2448-30-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1796-29-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1796-28-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4992-22-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4992-21-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3800-16-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3800-15-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1948-7-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2232-3-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2232-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2232-0-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1948-9-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1796-89-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4884-87-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 3352 set thread context of 2232	3352	loader.exe	80
PID 3352 set thread context of 3148	3352	loader.exe	81
PID 3352 set thread context of 1948	3352	loader.exe	82
PID 3352 set thread context of 1176	3352	loader.exe	83
PID 3352 set thread context of 4884	3352	loader.exe	84
PID 3352 set thread context of 3876	3352	loader.exe	85
PID 3352 set thread context of 3800	3352	loader.exe	86
PID 3352 set thread context of 2372	3352	loader.exe	87
PID 3352 set thread context of 4992	3352	loader.exe	88
PID 3352 set thread context of 2448	3352	loader.exe	89
PID 3352 set thread context of 2240	3352	loader.exe	90
PID 3352 set thread context of 1796	3352	loader.exe	91
PID 3352 set thread context of 2348	3352	loader.exe	92
PID 3352 set thread context of 2276	3352	loader.exe	93
PID 3352 set thread context of 3012	3352	loader.exe	94

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe
3352	loader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3352	loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2232	3352	loader.exe	80
PID 3352 wrote to memory of 2232	3352	loader.exe	80
PID 3352 wrote to memory of 2232	3352	loader.exe	80
PID 3352 wrote to memory of 2232	3352	loader.exe	80
PID 3352 wrote to memory of 2232	3352	loader.exe	80
PID 3352 wrote to memory of 2232	3352	loader.exe	80
PID 3352 wrote to memory of 2232	3352	loader.exe	80
PID 3352 wrote to memory of 3148	3352	loader.exe	81
PID 3352 wrote to memory of 3148	3352	loader.exe	81
PID 3352 wrote to memory of 3148	3352	loader.exe	81
PID 3352 wrote to memory of 3148	3352	loader.exe	81
PID 3352 wrote to memory of 3148	3352	loader.exe	81
PID 3352 wrote to memory of 3148	3352	loader.exe	81
PID 3352 wrote to memory of 3148	3352	loader.exe	81
PID 3352 wrote to memory of 1948	3352	loader.exe	82
PID 3352 wrote to memory of 1948	3352	loader.exe	82
PID 3352 wrote to memory of 1948	3352	loader.exe	82
PID 3352 wrote to memory of 1948	3352	loader.exe	82
PID 3352 wrote to memory of 1948	3352	loader.exe	82
PID 3352 wrote to memory of 1948	3352	loader.exe	82
PID 3352 wrote to memory of 1948	3352	loader.exe	82
PID 3352 wrote to memory of 1176	3352	loader.exe	83
PID 3352 wrote to memory of 1176	3352	loader.exe	83
PID 3352 wrote to memory of 1176	3352	loader.exe	83
PID 3352 wrote to memory of 1176	3352	loader.exe	83
PID 3352 wrote to memory of 1176	3352	loader.exe	83
PID 3352 wrote to memory of 1176	3352	loader.exe	83
PID 3352 wrote to memory of 1176	3352	loader.exe	83
PID 3352 wrote to memory of 4884	3352	loader.exe	84
PID 3352 wrote to memory of 4884	3352	loader.exe	84
PID 3352 wrote to memory of 4884	3352	loader.exe	84
PID 3352 wrote to memory of 4884	3352	loader.exe	84
PID 3352 wrote to memory of 4884	3352	loader.exe	84
PID 3352 wrote to memory of 4884	3352	loader.exe	84
PID 3352 wrote to memory of 4884	3352	loader.exe	84
PID 3352 wrote to memory of 3876	3352	loader.exe	85
PID 3352 wrote to memory of 3876	3352	loader.exe	85
PID 3352 wrote to memory of 3876	3352	loader.exe	85
PID 3352 wrote to memory of 3876	3352	loader.exe	85
PID 3352 wrote to memory of 3876	3352	loader.exe	85
PID 3352 wrote to memory of 3876	3352	loader.exe	85
PID 3352 wrote to memory of 3876	3352	loader.exe	85
PID 3352 wrote to memory of 3800	3352	loader.exe	86
PID 3352 wrote to memory of 3800	3352	loader.exe	86
PID 3352 wrote to memory of 3800	3352	loader.exe	86
PID 3352 wrote to memory of 3800	3352	loader.exe	86
PID 3352 wrote to memory of 3800	3352	loader.exe	86
PID 3352 wrote to memory of 3800	3352	loader.exe	86
PID 3352 wrote to memory of 3800	3352	loader.exe	86
PID 3352 wrote to memory of 2372	3352	loader.exe	87
PID 3352 wrote to memory of 2372	3352	loader.exe	87
PID 3352 wrote to memory of 2372	3352	loader.exe	87
PID 3352 wrote to memory of 2372	3352	loader.exe	87
PID 3352 wrote to memory of 2372	3352	loader.exe	87
PID 3352 wrote to memory of 2372	3352	loader.exe	87
PID 3352 wrote to memory of 2372	3352	loader.exe	87
PID 3352 wrote to memory of 4992	3352	loader.exe	88
PID 3352 wrote to memory of 4992	3352	loader.exe	88
PID 3352 wrote to memory of 4992	3352	loader.exe	88
PID 3352 wrote to memory of 4992	3352	loader.exe	88
PID 3352 wrote to memory of 4992	3352	loader.exe	88
PID 3352 wrote to memory of 4992	3352	loader.exe	88
PID 3352 wrote to memory of 4992	3352	loader.exe	88
PID 3352 wrote to memory of 2448	3352	loader.exe	89

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:2232
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:3148
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:1948
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:1176
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:4884
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:3876
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:3800
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:2372
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:4992
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:2448
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:1796
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:2348
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:2276
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-13-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1176-14-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1176-44-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1176-72-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1796-89-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1796-29-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1796-28-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1796-49-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1948-9-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1948-62-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1948-43-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1948-7-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2232-3-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2232-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2232-0-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2232-53-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2240-48-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2240-70-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2240-27-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2240-26-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2276-36-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2276-64-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2276-37-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2276-52-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2348-51-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2348-35-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2348-33-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2348-66-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2372-74-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2372-46-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2372-20-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2372-18-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2448-68-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2448-30-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2448-32-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2448-50-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3012-39-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3012-41-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3012-54-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3012-85-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3148-79-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3148-42-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3148-6-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3148-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3148-8-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3352-90-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3352-40-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3800-45-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3800-15-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3800-16-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3800-81-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3876-60-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3876-56-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3876-58-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3876-84-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4884-57-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4884-55-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4884-59-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4884-87-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4992-76-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4992-47-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4992-21-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4992-22-0x0000000140000000-0x0000000140015000-memory.dmp

Download