darksiderat | 223ad6d541be77d1255210bcae904a06b714bac0dfccff5ac717859bf4a203e8

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/10/2026, 19:44

Target
2026-10-27_d7035d03773e0713ec092c078916024d_cobalt-strike_icedid_njrat_stealc.exe
Size 361KB
Sample261028-yf7pqstyc1
SHA256 223ad6d541be77d1255210bcae904a06b714bac0dfccff5ac717859bf4a203e8
MD5 d7035d03773e0713ec092c078916024d
SHA1 7a71f71b96ddd2de84f7a45e251c9e3e30009720
SHA512 719e6d147a18ea1864cd9e9c9397a4cd846e22e62e2a0bdde6bd03750ab1e18289f456a50ffbcb15382caca7e1c30a9dc09a2c6ef82000f4be123bbe8db90491
SSDEEP 6144:yoSf6NOxQ82Kr3FNNenuO3Ut8q+354vZ:9Sf87M3FNNEukNq+
TLSH
T11B74AE19F76514F9E5A7C53DC8524542E732BC064BA0DADF23E00A962F336E49E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4744-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4744-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5644 set thread context of 4744	5644	2026-10-27_d7035d03773e0713ec092c078916024d_cobalt-strike_icedid_njrat_stealc.exe	91

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 4744	5644	2026-10-27_d7035d03773e0713ec092c078916024d_cobalt-strike_icedid_njrat_stealc.exe	91
PID 5644 wrote to memory of 4744	5644	2026-10-27_d7035d03773e0713ec092c078916024d_cobalt-strike_icedid_njrat_stealc.exe	91
PID 5644 wrote to memory of 4744	5644	2026-10-27_d7035d03773e0713ec092c078916024d_cobalt-strike_icedid_njrat_stealc.exe	91
PID 5644 wrote to memory of 4744	5644	2026-10-27_d7035d03773e0713ec092c078916024d_cobalt-strike_icedid_njrat_stealc.exe	91
PID 5644 wrote to memory of 4744	5644	2026-10-27_d7035d03773e0713ec092c078916024d_cobalt-strike_icedid_njrat_stealc.exe	91
PID 5644 wrote to memory of 4744	5644	2026-10-27_d7035d03773e0713ec092c078916024d_cobalt-strike_icedid_njrat_stealc.exe	91
PID 5644 wrote to memory of 4744	5644	2026-10-27_d7035d03773e0713ec092c078916024d_cobalt-strike_icedid_njrat_stealc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-27_d7035d03773e0713ec092c078916024d_cobalt-strike_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-27_d7035d03773e0713ec092c078916024d_cobalt-strike_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Users\Admin\AppData\Local\Temp\2026-10-27_d7035d03773e0713ec092c078916024d_cobalt-strike_icedid_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-27_d7035d03773e0713ec092c078916024d_cobalt-strike_icedid_njrat_stealc.exe"
  2⤵
  PID:4744

memory/4744-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4744-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5644-0-0x0000000140000000-0x000000014006C000-memory.dmp

Download

memory/5644-3-0x0000000140000000-0x000000014006C000-memory.dmp

Download