darksiderat | b9464d1eedf3532a7c4e1c2422f0dadeb738d2534156244ba392769a48cbd564

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 16:14

Target
2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe
Size 139KB
Sample261027-tpmcyaea36
SHA256 b9464d1eedf3532a7c4e1c2422f0dadeb738d2534156244ba392769a48cbd564
MD5 5f549587a92bdb66fc23d9de1dfc106d
SHA1 18d748a7e7ed86f1257b3f6bb813164f077df762
SHA512 09f5cc1d39e36e48aa764b015d0a79b888bbf4e0331a10aa0dfc55d4a3d511de75dc1bb97a31409fa43291950591ee1e558c10dc8ecdd8e62969966dfe5989fb
SSDEEP 3072:XnvrR8tkNgkxBhpsSyig8sBoxvpxYBXUY6+WSvm:XTDNgkxWSy/k4G
TLSH
T1B7D36C46ABE531F9E17B8678C4A20A16D772F83647719FEF07A042561F237D08E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/3212-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3212-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2768 set thread context of 3212	2768	2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2768	2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe
2768	2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 3212	2768	2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe	89
PID 2768 wrote to memory of 3212	2768	2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe	89
PID 2768 wrote to memory of 3212	2768	2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe	89
PID 2768 wrote to memory of 3212	2768	2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe	89
PID 2768 wrote to memory of 3212	2768	2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe	89
PID 2768 wrote to memory of 3212	2768	2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe	89
PID 2768 wrote to memory of 3212	2768	2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom.exe"
  2⤵
  PID:3212

memory/2768-0-0x0000000140000000-0x0000000140033000-memory.dmp

Download

memory/2768-3-0x0000000140000000-0x0000000140033000-memory.dmp

Download

memory/2768-4-0x0000000140000000-0x0000000140033000-memory.dmp

Download

memory/3212-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3212-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download