darksiderat | ac2bba19c0a8b5bc05a2c0f0d0f7280d07c2f7557ccadb3c2e9784b148558a1b

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 21:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-20_facd833782f61d30149f779a0a38ffe8_cobalt-strike_elex_icedid_stealc.exe
Size 356KB
Sample260920-1wh3estvb1
SHA256 ac2bba19c0a8b5bc05a2c0f0d0f7280d07c2f7557ccadb3c2e9784b148558a1b
MD5 facd833782f61d30149f779a0a38ffe8
SHA1 4b7a1db6aba956304a6798c4316226f4110abd29
SHA512 f1aba1432e3fe02d0840bc48a7e6c68923e589a0b6a41049661f51473ded80b4eda07bb43da662104ed10cd19c3a2314edb05f982865d3a06f427a4e79aafed1
SSDEEP 6144:jCe2PYzQwRTZfuaLFnaVLljG0/o4Y5X3u+530Y9:jQAU2ZfrVwjG0R+X3930
TLSH
T104748C15E6A934BFD2238039CE4A0901EE62BC594769EFEB27C14DA14ED3AD06F3C751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5c6-5.dat	family_darksiderat

Executes dropped EXE 2 IoCs

pid	Process
4000	loader (1).exe
4424	r4 (1).exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4000	4120	2026-09-20_facd833782f61d30149f779a0a38ffe8_cobalt-strike_elex_icedid_stealc.exe	89
PID 4120 wrote to memory of 4424	4120	2026-09-20_facd833782f61d30149f779a0a38ffe8_cobalt-strike_elex_icedid_stealc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-20_facd833782f61d30149f779a0a38ffe8_cobalt-strike_elex_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-20_facd833782f61d30149f779a0a38ffe8_cobalt-strike_elex_icedid_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Roaming\RuntimeCache\f0ada83e\loader (1).exe
  "C:\Users\Admin\AppData\Roaming\RuntimeCache\f0ada83e\loader (1).exe"
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Users\Admin\AppData\Roaming\RuntimeCache\f0ada83e\r4 (1).exe
  "C:\Users\Admin\AppData\Roaming\RuntimeCache\f0ada83e\r4 (1).exe"
  2⤵
  - Executes dropped EXE
  PID:4424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

loader (1).exe

Path C:\Users\Admin\AppData\Roaming\RuntimeCache\f0ada83e\loader (1).exe
Size 87KB
SHA256 5dd24475c2d0112a7d78bb370a614bdbab63c002ec5bdf583eee363435dd617b
MD5 270d33a8163560eff5f838db802597c2
SHA1 9571ed5d8a2745b5c78dfb1c8560efe5e59517e1
SHA512 42beca3ce48e2930d3375ee1020ee344e5deb4aa81395867cdca07848ae9a0965141f22193268173d30639ef97956b5a58a147b1f22f7f8149fe8aab937b1b34
SSDEEP 768:Pv4MtWJpsQysK8Gk5Iw3UjOar7uL/AjVP7f1J7DMAalg+JWAhz8wVgz8XzHN0ZSO:8aUxtLf3RpepomTcnZJDjolYu1l/
TLSH
T17693D535DE9DB12ED2059478EE564C06DE63B88E8695BFA32BC24DC10FDAF601F2C590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r4 (1).exe

Path C:\Users\Admin\AppData\Roaming\RuntimeCache\f0ada83e\r4 (1).exe
Size 238KB
SHA256 f67c73f57dbf2f40aad500dcbcbf0772dbd916fe1cd0d52f3f52d9d1ec6d9a4a
MD5 69b9705214c708247190d67766111ad2
SHA1 2eec10b566d2c2d92f8fca2d0617b5394ed2a5e0
SHA512 0891c192c8c286cae1c8f9e29f8e36154b35e158583c30df62e973be790ebdd7d726bc54b1489c4a57271cb256af3dd1917decfe75a72f4e3bfd1ef30d594505
SSDEEP 6144:/zQwRTZfuaLFnaVLljG0/o4Y5X3u+530L:/U2ZfrVwjG0R+X3930L
TLSH
T18A346D09E2F528FED2638036CA8A1241EE717C544769CDEF13958AB58DE35D0AF3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4120-0-0x00007FFD7C96F000-0x00007FFD7C970000-memory.dmp

Download

memory/4120-1-0x00000000001A0000-0x00000000001FA000-memory.dmp

Download

memory/4120-7-0x00007FFD7C7E0000-0x00007FFD7D184000-memory.dmp

Download

memory/4120-11-0x00007FFD7C7E0000-0x00007FFD7D184000-memory.dmp

Download

memory/4120-12-0x00007FFD7C7E0000-0x00007FFD7D184000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads