darksiderat | 0d62e81fb642b3253d9b841f24f01f53c9770360650eb5eccbd2b6b4ef8416e2

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 11:02

Target
2026-10-02_681f565984858e02ca002988f385bad0_cobalt-strike_icedid_stealc.exe
Size 225KB
Sample261003-m5l9jsxamd
SHA256 0d62e81fb642b3253d9b841f24f01f53c9770360650eb5eccbd2b6b4ef8416e2
MD5 681f565984858e02ca002988f385bad0
SHA1 0b24ad3b49be8c2b809e26f7c17d3ccfb78fe522
SHA512 783bfe59d73ec141106d4277810a26e57759d106608102f71673ddc41c0213178a8e128c6adbef782643eb777452ff6f25da096619695b95dc6d4de0acdb2eac
SSDEEP 3072:H1zYssN+EfZB8DlbDi4irBq0Y/qgq4ggsywJRnviPUY6+WSvm:H1zYPN++B8DA4gBql+jRvx
TLSH
T1A0347E07EBA620FAE17B8574C9824906FB727C6647A1ABDF07904AB60F237D05E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4156-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4156-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3208 set thread context of 4156	3208	2026-10-02_681f565984858e02ca002988f385bad0_cobalt-strike_icedid_stealc.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 4156	3208	2026-10-02_681f565984858e02ca002988f385bad0_cobalt-strike_icedid_stealc.exe	90
PID 3208 wrote to memory of 4156	3208	2026-10-02_681f565984858e02ca002988f385bad0_cobalt-strike_icedid_stealc.exe	90
PID 3208 wrote to memory of 4156	3208	2026-10-02_681f565984858e02ca002988f385bad0_cobalt-strike_icedid_stealc.exe	90
PID 3208 wrote to memory of 4156	3208	2026-10-02_681f565984858e02ca002988f385bad0_cobalt-strike_icedid_stealc.exe	90
PID 3208 wrote to memory of 4156	3208	2026-10-02_681f565984858e02ca002988f385bad0_cobalt-strike_icedid_stealc.exe	90
PID 3208 wrote to memory of 4156	3208	2026-10-02_681f565984858e02ca002988f385bad0_cobalt-strike_icedid_stealc.exe	90
PID 3208 wrote to memory of 4156	3208	2026-10-02_681f565984858e02ca002988f385bad0_cobalt-strike_icedid_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-02_681f565984858e02ca002988f385bad0_cobalt-strike_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_681f565984858e02ca002988f385bad0_cobalt-strike_icedid_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\2026-10-02_681f565984858e02ca002988f385bad0_cobalt-strike_icedid_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_681f565984858e02ca002988f385bad0_cobalt-strike_icedid_stealc.exe"
  2⤵
  PID:4156

memory/3208-0-0x0000000140000000-0x000000014004B000-memory.dmp

Download

memory/3208-3-0x0000000140000000-0x000000014004B000-memory.dmp

Download

memory/3208-4-0x0000000140000000-0x000000014004B000-memory.dmp

Download

memory/4156-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4156-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download