Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 02:10
General
- Target 2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe
- Size 30.8MB
- Sample261027-cl1bysxx3m
- SHA256 83cc03f7f347543373591ab9a4b4d7f011005e9b81815bcac882c3ab00f240f6
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe"2⤵
-
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2016-14-0x00007FF677130000-0x00007FF679011000-memory.dmp
memory/4768-3-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4768-4-0x0000000140000000-0x0000000140015000-memory.dmp
memory/5828-7-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
memory/5828-2-0x0000000140000000-0x0000000141EE1000-memory.dmp
memory/5828-6-0x00000001414E3000-0x0000000141EC9000-memory.dmp
memory/5828-5-0x0000000140000000-0x0000000141EE1000-memory.dmp
memory/5828-8-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
memory/5828-9-0x0000000140000000-0x0000000141EE1000-memory.dmp
memory/5828-10-0x0000000140000000-0x0000000141EE1000-memory.dmp
memory/5828-13-0x0000000140000000-0x0000000141EE1000-memory.dmp
memory/5828-1-0x0000000140000000-0x0000000141EE1000-memory.dmp
memory/5828-27-0x0000000140000000-0x0000000141EE1000-memory.dmp