darksiderat | 08f8f0615be528ee20dcc0c01523f2cb762814c591c133089d8fb5bcc2b81eea

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 06:04

Target
fortnite_cleaner_gui.exe
Size 796KB
Sample260916-gs41yahg66
SHA256 08f8f0615be528ee20dcc0c01523f2cb762814c591c133089d8fb5bcc2b81eea
MD5 12cc07d771494aa4119e3883f856abec
SHA1 3156d847de6e9f5fb8f1dead7382816312fe399c
SHA512 f4a953a02e4e2cb21fdb796b8b8e4ddc4e0c78ca4cafcb1ab410d0d51181b7b7636c76e39db2ef2c1d858bc0369c8b8bf40148ad75eec2ab0b3245fc36c6704a
SSDEEP 12288:cR3y6qF5o/83nHPiL4tW3A3qgyxaBKtQuWw7bGx7nGoVWfJ3V3r:ci5o/Y6yr3qZxaBKtQz7nG1F
TLSH
T1F105AE59F7E801FCE077D138D9626607EA36785513309ADF2390066E2F336E45A7BB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/2556-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2556-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1240 set thread context of 2556	1240	fortnite_cleaner_gui.exe	87

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1240	fortnite_cleaner_gui.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1240	fortnite_cleaner_gui.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 2556	1240	fortnite_cleaner_gui.exe	87
PID 1240 wrote to memory of 2556	1240	fortnite_cleaner_gui.exe	87
PID 1240 wrote to memory of 2556	1240	fortnite_cleaner_gui.exe	87
PID 1240 wrote to memory of 2556	1240	fortnite_cleaner_gui.exe	87
PID 1240 wrote to memory of 2556	1240	fortnite_cleaner_gui.exe	87
PID 1240 wrote to memory of 2556	1240	fortnite_cleaner_gui.exe	87
PID 1240 wrote to memory of 2556	1240	fortnite_cleaner_gui.exe	87

C:\Users\Admin\AppData\Local\Temp\fortnite_cleaner_gui.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite_cleaner_gui.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\fortnite_cleaner_gui.exe
  "C:\Users\Admin\AppData\Local\Temp\fortnite_cleaner_gui.exe"
  2⤵
  PID:2556

memory/1240-0-0x0000000140000000-0x00000001400D9000-memory.dmp

Download

memory/1240-4-0x0000000140000000-0x00000001400D9000-memory.dmp

Download

memory/2556-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2556-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download