darksiderat | 7d73fe1945dcee52b386674cffa8b3d384a42333a1829e7dc724d28879e5c8df

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:30

Target
2026-09-25_979f068fec9ae0269e5dda34bdaa1705_conti.exe
Size 116KB
Sample260925-2e76naaa47
SHA256 7d73fe1945dcee52b386674cffa8b3d384a42333a1829e7dc724d28879e5c8df
MD5 979f068fec9ae0269e5dda34bdaa1705
SHA1 8584769c6a30382ba899bed7e5e55190a18071d2
SHA512 6ead8959f23e8d68891077a170334b87b67ac3e58f3dfc977f097441d5eaf55dc051a321818a0152a6875cf1c5561b3d0e2ec34d79d6d8aa06476917d0ce3845
SSDEEP 3072:8haeE5cC19G2ZFkwxsRpHfmjnAuuH9UY6+WSvm:SaDG0dpuHS
TLSH
T158C38C16D74314FDD11FD17885E39673B932B8264320AEBBA358D7311F30E606F69A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/1248-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1248-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2656 set thread context of 1248	2656	2026-09-25_979f068fec9ae0269e5dda34bdaa1705_conti.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1248	2656	2026-09-25_979f068fec9ae0269e5dda34bdaa1705_conti.exe	90
PID 2656 wrote to memory of 1248	2656	2026-09-25_979f068fec9ae0269e5dda34bdaa1705_conti.exe	90
PID 2656 wrote to memory of 1248	2656	2026-09-25_979f068fec9ae0269e5dda34bdaa1705_conti.exe	90
PID 2656 wrote to memory of 1248	2656	2026-09-25_979f068fec9ae0269e5dda34bdaa1705_conti.exe	90
PID 2656 wrote to memory of 1248	2656	2026-09-25_979f068fec9ae0269e5dda34bdaa1705_conti.exe	90
PID 2656 wrote to memory of 1248	2656	2026-09-25_979f068fec9ae0269e5dda34bdaa1705_conti.exe	90
PID 2656 wrote to memory of 1248	2656	2026-09-25_979f068fec9ae0269e5dda34bdaa1705_conti.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-25_979f068fec9ae0269e5dda34bdaa1705_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_979f068fec9ae0269e5dda34bdaa1705_conti.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\2026-09-25_979f068fec9ae0269e5dda34bdaa1705_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-25_979f068fec9ae0269e5dda34bdaa1705_conti.exe"
  2⤵
  PID:1248

memory/1248-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1248-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2656-0-0x0000000140000000-0x0000000140043000-memory.dmp

Download

memory/2656-4-0x0000000140000000-0x0000000140043000-memory.dmp

Download