darksiderat | 7e15806991107bffd8905138c3c3df759ac7de0d716d24ecaf12c963d95993d3

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 6.8MB
Sample260925-zn2dcsxt6j
SHA256 7e15806991107bffd8905138c3c3df759ac7de0d716d24ecaf12c963d95993d3
MD5 b45531d48dafec76a6a491f49985b306
SHA1 4d2b455c12dccaa389c9085d0f8d59fbacadf843
SHA512 46a1609b5f6a62853b26875b982b34f89fef321d7cc083d3238c0bad12e14c64ba9aead2a965f571fb274ea05d11f3747d8fc0ee194d43dc911be0f63b26c1f8
SSDEEP 196608:27YV1W903eV4Q+tpDjIIAcwD0RPzaXIL:uYLW+eGQ69jo0P
TLSH
T190763390E2E81AF9E9B3853E8A91811BE632BC62077CC6C743E496533F233D5597E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/4380-5-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4380-9-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1388-21-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Loads dropped DLL 6 IoCs

pid	Process
3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4120 set thread context of 4380	4120	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 3412 set thread context of 1388	3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4380	4120	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4120 wrote to memory of 4380	4120	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4120 wrote to memory of 4380	4120	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4120 wrote to memory of 4380	4120	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4120 wrote to memory of 4380	4120	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4120 wrote to memory of 4380	4120	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4120 wrote to memory of 4380	4120	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4120 wrote to memory of 3412	4120	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 3412 wrote to memory of 1388	3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 3412 wrote to memory of 1388	3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 3412 wrote to memory of 1388	3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 3412 wrote to memory of 1388	3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 3412 wrote to memory of 1388	3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 3412 wrote to memory of 1388	3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 3412 wrote to memory of 1388	3412	2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  PID:4380
- C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    3⤵
    PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41202\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41202\_bz2.pyd
Size 82KB
SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
MD5 c7ce973f261f698e3db148ccad057c96
SHA1 59809fd48e8597a73211c5df64c7292c5d120a10
SHA512 a924750b1825747a622eef93331fd764d824c954297e37e8dc93a450c11aa7ab3ad7c3b823b11656b86e64de3cd5d409fda15db472488dfaa4bb50341f0b29d1
SSDEEP 1536:FFzZz757cav+IuK66nlxX8W8LsANVIGCV87SyixL7:DzZzq6n3MhLsMVIGCV8O7
TLSH
T1F2839E93F3A055B5E41BA27699A10357E371FD4A039093EFB348835B2F13B913D6932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41202\_lzma.pyd
Size 155KB
SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
MD5 4e2239ece266230ecb231b306adde070
SHA1 e807a078b71c660db10a27315e761872ffd01443
SHA512 86e6a1eab3529e600dd5caab6103e34b0f618d67322a5ecf1b80839faa028150c492a5cf865a2292cc8584fba008955da81a50b92301583424401d249c5f1401
SSDEEP 3072:RmuEE9tZBoI+1hINrznfB9mNoNSn2Vh/VDxuVIGZ1L6E:RmuFPobkNpYONnvfuCE
TLSH
T14DF33992A394F4E5F7228C78D6624F13D7F678490310929A12CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41202\_socket.pyd
Size 81KB
SHA256 b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
MD5 899380b2d48df53414b974e11bb711e3
SHA1 f1d11f7e970a7cd476e739243f8f197fcb3ad590
SHA512 7426ca5e7a404b9628e2966dae544f3e8310c697145567b361825dc0b5c6cd87f2caf567def8cd19e73d68643f2f38c08ff4ff0bb0a459c853f241b8fdf40024
SSDEEP 1536:ZUuhzLx79flWrqcqtpjly+uCo9/s+S+pzcHQ6B48/VI9dsSbxntpIGLwIU7SyZxL:ZU6zLRNawRy+uCo9/sT+pzuXxVIbsSde
TLSH
T179834911A69050F9DBB3C17AC6635F23FB74B4C01390A39F1196C66A1F33782BE79A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI41202\base_library.zip
Size 1.3MB
SHA256 8d3ee705170a1aafee5e1f5661b2bddb7439a3c8f2d63d80226194826266a4bb
MD5 7c9354b62eaa6e383b194cc70b43eadb
SHA1 446f5c011337e126d84390d0be67fa46183601e9
SHA512 82204e80850e3a30e591087b53db74fd67b548f76ff5cb08c8f50b27d971aa02f23af2b4fed469ae399188e8d0cd338313f4ea22937dff128d0aba86263c8b87
SSDEEP 12288:ZM/Zw0P6dYJgCQD9ZVJHtzJYTq+zYgEkA1qJuAgaYcxgWw1cOmgRJttcY+b79:X0P6dYJm1JtJ3aYcGWZHCJttcY+P9
TLSH
T18F55D681B692B5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2A49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41202\python312.dll
Size 6.6MB
SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
MD5 5c5602cda7ab8418420f223366fff5db
SHA1 52f81ee0aef9b6906f7751fd2bbd4953e3f3b798
SHA512 51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
TLSH
T1C3667C26B758D0A9C9669074CC23C2DAE7717C51BF10530F30EAB31E2F7779256AA788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41202\select.pyd
Size 30KB
SHA256 bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab
MD5 bffff83a000baf559f3eb2b599a1b7e8
SHA1 7f9238bda6d0c7cc5399c6b6ab3b42d21053f467
SHA512 3c0ba0cf356a727066ae0d0d6523440a882aafb3ebdf70117993effd61395deebf179948f8c7f5222d59d1ed748c71d9d53782e16bd2f2eccc296f2f8b4fc948
SSDEEP 768:s7ENJKHq1vv38pIGQGE5YiSyvTcAMxkEMrX:s7ENJKK1vv38pIGQGO7Syb6xuX
TLSH
T13ED29E97AF601845D823C972A9E74E26ED32B6A7475083CB3368C15C1F227C277BB764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1388-21-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3412-15-0x0000000140000000-0x00000001406E2000-memory.dmp

Download

memory/3412-31-0x0000000140000000-0x00000001406E2000-memory.dmp

Download

memory/4120-0-0x0000000140000000-0x00000001406E2000-memory.dmp

Download

memory/4120-30-0x0000000140000000-0x00000001406E2000-memory.dmp

Download

memory/4380-9-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4380-5-0x0000000140000000-0x0000000140015000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads