darksiderat | 03876b3b2fb78950931b058b28828e9e260b0867039e7e324d46a848c4ae47b3

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 15:16

Target
2026-10-02_2d9f7da567bd58268cb607ddd875f132_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe
Size 6.3MB
Sample261003-snr2cs1flb
SHA256 03876b3b2fb78950931b058b28828e9e260b0867039e7e324d46a848c4ae47b3
MD5 2d9f7da567bd58268cb607ddd875f132
SHA1 c0e8c336148ae76a2ea11865064e2998a5fdeff9
SHA512 81fa3b28b0ec0be7f5cf959e0c694e8f01b326ca572418a2233353d05598c703e8739babe571292020f0198e5c6fc236174c032b43ba696ea4385d53c92dbb7e
SSDEEP 49152:a5MyZyWWkfCUzOgVSvFs/yg2ClwtVvgRDPI0u/lXE4Rp6lntiZzS+P+POgQWnr4m:ThK6AwfVlE4qNm+Gyou/0+Ht
TLSH
T1F16607207BAA59ADC19AC47083464A725E3130DB0B39B9FF44C592793F79AF51F3C268
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/3152-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3152-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4216 set thread context of 3152	4216	2026-10-02_2d9f7da567bd58268cb607ddd875f132_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 3152	4216	2026-10-02_2d9f7da567bd58268cb607ddd875f132_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe	90
PID 4216 wrote to memory of 3152	4216	2026-10-02_2d9f7da567bd58268cb607ddd875f132_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe	90
PID 4216 wrote to memory of 3152	4216	2026-10-02_2d9f7da567bd58268cb607ddd875f132_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe	90
PID 4216 wrote to memory of 3152	4216	2026-10-02_2d9f7da567bd58268cb607ddd875f132_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe	90
PID 4216 wrote to memory of 3152	4216	2026-10-02_2d9f7da567bd58268cb607ddd875f132_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe	90
PID 4216 wrote to memory of 3152	4216	2026-10-02_2d9f7da567bd58268cb607ddd875f132_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe	90
PID 4216 wrote to memory of 3152	4216	2026-10-02_2d9f7da567bd58268cb607ddd875f132_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-02_2d9f7da567bd58268cb607ddd875f132_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_2d9f7da567bd58268cb607ddd875f132_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Local\Temp\2026-10-02_2d9f7da567bd58268cb607ddd875f132_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_2d9f7da567bd58268cb607ddd875f132_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe"
  2⤵
  PID:3152

memory/3152-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3152-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4216-0-0x0000000140000000-0x000000014065E000-memory.dmp

Download

memory/4216-3-0x0000000140000000-0x000000014065E000-memory.dmp

Download