darksiderat | 2ef3781d1be12ddd3b86df84d9c63a2da60c25bf664228e7e61f2006fda342ec

Analysis

max time kernel
148s
max time network
110s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 23:40

Target
2026-09-13_ffb563cbd1ffe8aedaf7c72772a13007_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 203KB
Sample260913-3pbe4sshmb
SHA256 2ef3781d1be12ddd3b86df84d9c63a2da60c25bf664228e7e61f2006fda342ec
MD5 ffb563cbd1ffe8aedaf7c72772a13007
SHA1 5899b1843dac33cc585b25991a3b327a383376a0
SHA512 9849fae5fbb3ec1240c6e8c78ba5faba3ddf6c0b15f1ae0d5a9c947a433b0f8fc7571bfebc758c3bb283c31bbc7b0318bc7e9bc5dc59ebef9c8b9f2d02921c7e
SSDEEP 3072:n+/BpOvudd7JDF30af3UmB30wv5PGIMov2QpHRxI7AUJsrmUVOcd5oEEUY6+WSvm:NvudZJp30u31EwZGIMs2QprQWp5
TLSH
T173148D07B79131E5E17B9638C4A10657B773B8324760DBAF07A4826A1F332D19E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/1308-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1308-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5132 set thread context of 1308	5132	2026-09-13_ffb563cbd1ffe8aedaf7c72772a13007_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	88

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 1308	5132	2026-09-13_ffb563cbd1ffe8aedaf7c72772a13007_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	88
PID 5132 wrote to memory of 1308	5132	2026-09-13_ffb563cbd1ffe8aedaf7c72772a13007_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	88
PID 5132 wrote to memory of 1308	5132	2026-09-13_ffb563cbd1ffe8aedaf7c72772a13007_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	88
PID 5132 wrote to memory of 1308	5132	2026-09-13_ffb563cbd1ffe8aedaf7c72772a13007_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	88
PID 5132 wrote to memory of 1308	5132	2026-09-13_ffb563cbd1ffe8aedaf7c72772a13007_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	88
PID 5132 wrote to memory of 1308	5132	2026-09-13_ffb563cbd1ffe8aedaf7c72772a13007_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	88
PID 5132 wrote to memory of 1308	5132	2026-09-13_ffb563cbd1ffe8aedaf7c72772a13007_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-09-13_ffb563cbd1ffe8aedaf7c72772a13007_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_ffb563cbd1ffe8aedaf7c72772a13007_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Users\Admin\AppData\Local\Temp\2026-09-13_ffb563cbd1ffe8aedaf7c72772a13007_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ffb563cbd1ffe8aedaf7c72772a13007_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  PID:1308

memory/1308-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1308-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5132-0-0x0000000140000000-0x0000000140045000-memory.dmp

Download

memory/5132-3-0x0000000140000000-0x0000000140045000-memory.dmp

Download