darksiderat | ebc13617f7f669df54e892fdb8e83c226ed23bbb7ced86873a1a3bafd7bec39e

Analysis

user interaction
yes
max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/09/2026, 03:07

Target
loader (2).exe
Size 5.4MB
Sample260917-dmrlwawsb1
SHA256 ebc13617f7f669df54e892fdb8e83c226ed23bbb7ced86873a1a3bafd7bec39e
MD5 d7e7628c93fee97a455a2c571764b435
SHA1 cd54d6f8100eb97fd50fba575abac9304e3509a7
SHA512 c8fd0e489adee2ff6813a304e3874f0ac16145a2283fadf7cb2f7e5a62b3f910a569e900f5eeb5e090f0544a033f4db7f61c2a50e8a97ff6903dbb08ed8ab9c4
SSDEEP 98304:VkrRlwLisY4jnIfFDfrmbzRBmPdc+cTna4NpAV8O5Hm+PIjrKQ2VS+XWkIX/2gbH:GrRK3Y8IdfrmbzXi8lOZA/BkmkKegD
TLSH
T17E4633DA3AC726FDE049CBB48511147D71D47FCA45A0CD492B49E923AC67B2EAF3A304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/1212-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1212-0-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3464	loader (2).exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3464 set thread context of 1212	3464	loader (2).exe	88

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1212	3464	loader (2).exe	88
PID 3464 wrote to memory of 1212	3464	loader (2).exe	88
PID 3464 wrote to memory of 1212	3464	loader (2).exe	88
PID 3464 wrote to memory of 1212	3464	loader (2).exe	88
PID 3464 wrote to memory of 1212	3464	loader (2).exe	88
PID 3464 wrote to memory of 1212	3464	loader (2).exe	88
PID 3464 wrote to memory of 1212	3464	loader (2).exe	88

C:\Users\Admin\AppData\Local\Temp\loader (2).exe
"C:\Users\Admin\AppData\Local\Temp\loader (2).exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\AppData\Local\Temp\loader (2).exe
  "C:\Users\Admin\AppData\Local\Temp\loader (2).exe"
  2⤵
  PID:1212

memory/1212-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1212-0-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3464-2-0x0000000140000000-0x0000000140C39000-memory.dmp

Download