darksiderat | 5e57a6d2833725dfb0b18129a070210066d1b1841bc2922718ada880881d180d

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 16:13

Target
2026-10-11_8ef8add0198793cab716a231878d0491_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 283KB
Sample261012-tpfkdsty5n
SHA256 5e57a6d2833725dfb0b18129a070210066d1b1841bc2922718ada880881d180d
MD5 8ef8add0198793cab716a231878d0491
SHA1 3f51e9ef449eeff7b40f105f26c95b2f5f3a4ae9
SHA512 86beaf246421fd0d16427797a56ead036b6fce00b4fe511049d9cbc00d960fde929f723021d1a227ad683662cab71663d3198c038b591d86086899f31369ae11
SSDEEP 3072:Ql7o+erV9wbIDLci6jf+0aF7HqKAg7OqxO1BwMpdCq/IM8uIGfS/y36s1UY6+WSu:9HrvwbI4b+0a8Z1BwMd7wvcg
TLSH
T1A8545C02F76D3DEDE06AC134897185A2AB31FC311750969F52E177662E322D3BD2AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4488-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4488-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5060 set thread context of 4488	5060	2026-10-11_8ef8add0198793cab716a231878d0491_cobalt-strike_icedid_luca-stealer_njrat.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 4488	5060	2026-10-11_8ef8add0198793cab716a231878d0491_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 5060 wrote to memory of 4488	5060	2026-10-11_8ef8add0198793cab716a231878d0491_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 5060 wrote to memory of 4488	5060	2026-10-11_8ef8add0198793cab716a231878d0491_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 5060 wrote to memory of 4488	5060	2026-10-11_8ef8add0198793cab716a231878d0491_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 5060 wrote to memory of 4488	5060	2026-10-11_8ef8add0198793cab716a231878d0491_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 5060 wrote to memory of 4488	5060	2026-10-11_8ef8add0198793cab716a231878d0491_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 5060 wrote to memory of 4488	5060	2026-10-11_8ef8add0198793cab716a231878d0491_cobalt-strike_icedid_luca-stealer_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-11_8ef8add0198793cab716a231878d0491_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_8ef8add0198793cab716a231878d0491_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\2026-10-11_8ef8add0198793cab716a231878d0491_cobalt-strike_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-11_8ef8add0198793cab716a231878d0491_cobalt-strike_icedid_luca-stealer_njrat.exe"
  2⤵
  PID:4488

memory/4488-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4488-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5060-0-0x0000000140000000-0x0000000140059000-memory.dmp

Download

memory/5060-3-0x0000000140000000-0x0000000140059000-memory.dmp

Download