darksiderat | aecbbf497a38c44e23037c423a3b239cf3c667bd56490b9cadb589a708bc1c43

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 15:01

Target
2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe
Size 342KB
Sample261003-sd48ya117q
SHA256 aecbbf497a38c44e23037c423a3b239cf3c667bd56490b9cadb589a708bc1c43
MD5 315398cb0395449da930218f5ab127e2
SHA1 bd1512a2ca690c25082f8e3460c63781e753c4c8
SHA512 841ffcce6104a9ddaa39b14f36cdde305ed21671e8e4458cb2db41978eb7dcaf4b04ebc83d449ea5b4a9168fbb55fa09da64b56ffcb493f44d97ee3e662867d2
SSDEEP 6144:NpzQR3RFTzMUb6L3olYhep4rlpVjBKKL06ohhPOSYQmwB:NpzO3zD836qrXoDOS
TLSH
T116747C19B79504F9ED77813CCD528946EA72B8160770DAEF13A043663F236E09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4944-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4944-3-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4228 set thread context of 4944	4228	2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4944	4228	2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe	90
PID 4228 wrote to memory of 4944	4228	2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe	90
PID 4228 wrote to memory of 4944	4228	2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe	90
PID 4228 wrote to memory of 4944	4228	2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe	90
PID 4228 wrote to memory of 4944	4228	2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe	90
PID 4228 wrote to memory of 4944	4228	2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe	90
PID 4228 wrote to memory of 4944	4228	2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_315398cb0395449da930218f5ab127e2_cobalt-strike_icedid_njrat_vidar.exe"
  2⤵
  PID:4944

memory/4228-0-0x0000000140000000-0x0000000140068000-memory.dmp

Download

memory/4228-5-0x0000000140000000-0x0000000140068000-memory.dmp

Download

memory/4944-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4944-3-0x0000000140000000-0x0000000140015000-memory.dmp

Download