darksiderat | 53c0dc46470bd0b8b9669b91aaba3ba71a851e7e3226515276022089590bb94e

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 17:49

Target
2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe
Size 2.1MB
Sample261006-wec3mass2m
SHA256 53c0dc46470bd0b8b9669b91aaba3ba71a851e7e3226515276022089590bb94e
MD5 a5ea4b4ee86c4ae12575a41ff8cba625
SHA1 252e80a6bb4e5681dd4eb3f642ae912b254e8a9d
SHA512 05842a8776bd3cde5dcb3bdf2ddc45aee155d647b4e2010efbd08b358c947444577d1604f3967324d565bcd1d05b33bdd44092fc6a222737151fe17bd00083b7
SSDEEP 49152:wdwdxHP95Q76Mx/GOZoH3YD6o0rmCykeoVWh1iw:LxHP95Q76MxeOZoH3YeoqVw
TLSH
T12DA58D17F29650E8D469C0B597156132F972BC580B30B9EF07D49A652E73FE0AB3EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4860-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4860-6-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5212 set thread context of 4860	5212	2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5212	2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe
5212	2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 4860	5212	2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe	89
PID 5212 wrote to memory of 4860	5212	2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe	89
PID 5212 wrote to memory of 4860	5212	2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe	89
PID 5212 wrote to memory of 4860	5212	2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe	89
PID 5212 wrote to memory of 4860	5212	2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe	89
PID 5212 wrote to memory of 4860	5212	2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe	89
PID 5212 wrote to memory of 4860	5212	2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Users\Admin\AppData\Local\Temp\2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_a5ea4b4ee86c4ae12575a41ff8cba625_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom_vidar.exe"
  2⤵
  PID:4860

host_installer.log

Path C:\ProgramData\Tencent\QQ\remote\logs\host_installer.log
Size 552B
SHA256 8baa84aa2c8495eec16946d0ca56d2d57b891593c34f0b1bddcdf7214bb7e8a9
MD5 cb00cb7467490e2367d296867ae4ee90
SHA1 972d5e3f7f584326d939e98a08dcdb1066eb18ad
SHA512 8ab863960a84b910a1ed41a0af4b1771d7b0f8e422a204ad8458526e8a39554f1d8a883421521bc9f8c2eed3dfd5c67b6a6a5eedcdacdc91a0849878f4ef6524
TLSH
T11AF026008901CE7A5B2A81839B3D0CB77051F0E8726D47F85F53D2C8385CC8869710D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4860-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4860-6-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5212-0-0x0000000140000000-0x000000014023E000-memory.dmp

Download

memory/5212-7-0x0000000140000000-0x000000014023E000-memory.dmp

Download