Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/10/2026, 22:38
General
- Target 2026-10-02_f329747b00e08125e62cedf6c53e287d_cobalt-strike_icedid_njrat_satacom_vidar.exe
- Size 5.7MB
- Sample261002-2kkbsavblc
- SHA256 68d2b7c3b4d6b47bc64ebeaa46cc98be5cc835bf7fc0d1ba1b450d5d1734a137
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 7 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_f329747b00e08125e62cedf6c53e287d_cobalt-strike_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_f329747b00e08125e62cedf6c53e287d_cobalt-strike_icedid_njrat_satacom_vidar.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_f329747b00e08125e62cedf6c53e287d_cobalt-strike_icedid_njrat_satacom_vidar.exeC:\Users\Admin\AppData\Local\Temp\2026-10-02_f329747b00e08125e62cedf6c53e287d_cobalt-strike_icedid_njrat_satacom_vidar.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=121.0.5600.50 --initial-client-data=0x22c,0x230,0x234,0x1e4,0x238,0x14057da40,0x14057da4c,0x14057da582⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_f329747b00e08125e62cedf6c53e287d_cobalt-strike_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_f329747b00e08125e62cedf6c53e287d_cobalt-strike_icedid_njrat_satacom_vidar.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_f329747b00e08125e62cedf6c53e287d_cobalt-strike_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_f329747b00e08125e62cedf6c53e287d_cobalt-strike_icedid_njrat_satacom_vidar.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
debug.log
memory/4560-10-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4560-3-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4560-2-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4560-1-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4668-9-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/4668-13-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/4684-8-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4684-11-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4684-7-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4812-12-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/4812-17-0x0000000140000000-0x00000001405E8000-memory.dmp