darksiderat | 6e4f7a7ba95be8ca912581eeba3dcf43e5976e4f4754c703b36e4513fe400796

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 10:00

Target
2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe
Size 88KB
Sample261027-l1sebsb141
SHA256 6e4f7a7ba95be8ca912581eeba3dcf43e5976e4f4754c703b36e4513fe400796
MD5 a6c5940ecb25bf4f7fa16d7249187628
SHA1 97267826449cda5638f8b06584fb2ae2b1789313
SHA512 5edd7ed2c536099c7cd1ba9d60fd315e3a8d24fcc89aaaa5b655a287d359ae120ca50627977206cf0aab0cb1970e65c829066853f7718993901d4141b5c9e0bf
SSDEEP 1536:qlro1OMLCyMT/fQASaUVeEdAXy7AG8Du6+WSss/eYwp:qho1ZLCy+BUldhUY6+WSvm
TLSH
T124937C4EFF4254BDC55EC0B882A349676932B09A0F61E9CF4681D32E1E79BF41B3DA50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/1460-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1460-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5452 set thread context of 1460	5452	2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5452	2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe
5452	2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 1460	5452	2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe	90
PID 5452 wrote to memory of 1460	5452	2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe	90
PID 5452 wrote to memory of 1460	5452	2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe	90
PID 5452 wrote to memory of 1460	5452	2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe	90
PID 5452 wrote to memory of 1460	5452	2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe	90
PID 5452 wrote to memory of 1460	5452	2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe	90
PID 5452 wrote to memory of 1460	5452	2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Users\Admin\AppData\Local\Temp\2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom.exe"
  2⤵
  PID:1460

memory/1460-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1460-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5452-0-0x0000000140000000-0x0000000140038000-memory.dmp

Download

memory/5452-3-0x0000000140000000-0x0000000140038000-memory.dmp

Download