darksiderat | f69dc3625b4062f00470321d2c42fd91489486fefb9db0f3d1b5fa1c110a4cf5

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/10/2026, 23:41

Target
2026-10-04_e4438eaf90117b53946c76e5e68a76e7_conti.exe
Size 102KB
Sample261004-3pykmstwcs
SHA256 f69dc3625b4062f00470321d2c42fd91489486fefb9db0f3d1b5fa1c110a4cf5
MD5 e4438eaf90117b53946c76e5e68a76e7
SHA1 222033ca76ca2d03ce38ff3f19929afd9a5c61cc
SHA512 c74d809dd3d34f9e4e27263d2b3f835585cbcfca8f7580c3f6708b39d6c200ed22f1f00e747d937c163eeb5414aeabb28553d48a2bdceddc5fe37eb6be12dce7
SSDEEP 3072:/G3KknPUM3HkwxHMn5OmaB961/RVFUY6+WSvm:/faxB98/RVK
TLSH
T11AA39D0AFB5328FCC65ED0B890D297B3FA32B8190134AEBF5354D2762D30E955E1D52A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/3688-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3688-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5720 set thread context of 3688	5720	2026-10-04_e4438eaf90117b53946c76e5e68a76e7_conti.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5720 wrote to memory of 3688	5720	2026-10-04_e4438eaf90117b53946c76e5e68a76e7_conti.exe	90
PID 5720 wrote to memory of 3688	5720	2026-10-04_e4438eaf90117b53946c76e5e68a76e7_conti.exe	90
PID 5720 wrote to memory of 3688	5720	2026-10-04_e4438eaf90117b53946c76e5e68a76e7_conti.exe	90
PID 5720 wrote to memory of 3688	5720	2026-10-04_e4438eaf90117b53946c76e5e68a76e7_conti.exe	90
PID 5720 wrote to memory of 3688	5720	2026-10-04_e4438eaf90117b53946c76e5e68a76e7_conti.exe	90
PID 5720 wrote to memory of 3688	5720	2026-10-04_e4438eaf90117b53946c76e5e68a76e7_conti.exe	90
PID 5720 wrote to memory of 3688	5720	2026-10-04_e4438eaf90117b53946c76e5e68a76e7_conti.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-04_e4438eaf90117b53946c76e5e68a76e7_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-04_e4438eaf90117b53946c76e5e68a76e7_conti.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Users\Admin\AppData\Local\Temp\2026-10-04_e4438eaf90117b53946c76e5e68a76e7_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e4438eaf90117b53946c76e5e68a76e7_conti.exe"
  2⤵
  PID:3688

memory/3688-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3688-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5720-0-0x0000000140000000-0x000000014002F000-memory.dmp

Download

memory/5720-4-0x0000000140000000-0x000000014002F000-memory.dmp

Download