darksiderat | 4f6ed07a4cd1f6e71f8eb4fc9cf8e16c1ec17942258e34c61e72c01e5ee07148

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 01:43

Target
2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 15.7MB
Sample261102-b5k6psdh43
SHA256 4f6ed07a4cd1f6e71f8eb4fc9cf8e16c1ec17942258e34c61e72c01e5ee07148
MD5 fd254244ab814e4e52b4953d0b280cdd
SHA1 e142ff89f9ef71080a98aa3707680972aa8300cb
SHA512 7b01a560968be93a6c7da758509d743cbb427bbd21477fb9d3dad052ffaecf91fcafcf6236f37bd2ebfaaab1b65f97bc4bb67eb1154f161b0993a0d0fde8b496
SSDEEP 196608:2XOtGSm12GnqRloSXBYVx6ebU5prlUQQl6DRDqYc:2XOtGSmAqqYSRYVxFbUzrlBQlYDq
TLSH
T1FFF68E2662BC00EDD0BBC17DC6469A0BE7B27855437097DF0AE486B61F23AE45E7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/820-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/820-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2280 set thread context of 820	2280	2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	91

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 820	2280	2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	91
PID 2280 wrote to memory of 820	2280	2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	91
PID 2280 wrote to memory of 820	2280	2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	91
PID 2280 wrote to memory of 820	2280	2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	91
PID 2280 wrote to memory of 820	2280	2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	91
PID 2280 wrote to memory of 820	2280	2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	91
PID 2280 wrote to memory of 820	2280	2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:820

memory/820-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/820-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2280-0-0x0000000140000000-0x0000000140FD0000-memory.dmp

Download

memory/2280-3-0x0000000140000000-0x0000000140FD0000-memory.dmp

Download