Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
03/10/2026, 15:01
General
- Target 2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe
- Size 342KB
- Sample261003-sd48ya117q
- SHA256 aecbbf497a38c44e23037c423a3b239cf3c667bd56490b9cadb589a708bc1c43
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3696-2-0x0000000140000000-0x0000000140015000-memory.dmp
memory/3696-4-0x0000000140000000-0x0000000140015000-memory.dmp
memory/3696-3-0x0000000140000000-0x0000000140015000-memory.dmp
memory/3696-5-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4052-0-0x0000000140000000-0x0000000140068000-memory.dmp
memory/4052-7-0x0000000140000000-0x0000000140068000-memory.dmp