darksiderat | 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
Size 1.2MB
Sample261102-kjcf4sty7k
SHA256 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b
MD5 94dddde1a58961bedbecb8bcf4f73d9d
SHA1 c311a3fcd16504c435d6b1217ef0256d256e6651
SHA512 11f633f567e492a762f3607d0568453720e1055f4e1ed05935704d30a55a579c9cf0b11dda26eaadd7709ec9b36eeeb96701ee5f3153ab47b7729b52714e7e8e
SSDEEP 12288:RbguMWFuA62ZO0vzmEliO0vzmElvO0vzmElGO0vzmElNO0vzmElnO0vzmEl:BguMW/ZFzziFzzvFzzGFzzNFzznFzz
TLSH
T15745E10ADFDBCAD9D0BE94B9A4A560B7A261300E42D4DEDF3880915FDF719D06F28E50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 7 IoCs

resource	yara_rule
behavioral1/memory/3616-3-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1784-7-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1784-8-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1784-6-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/3616-4-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/3616-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/3616-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 3616	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	84
PID 4412 set thread context of 1784	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	85
PID 4412 set thread context of 2696	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	86
PID 4412 set thread context of 1248	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	87

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 3616	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	84
PID 4412 wrote to memory of 3616	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	84
PID 4412 wrote to memory of 3616	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	84
PID 4412 wrote to memory of 3616	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	84
PID 4412 wrote to memory of 3616	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	84
PID 4412 wrote to memory of 3616	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	84
PID 4412 wrote to memory of 3616	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	84
PID 4412 wrote to memory of 1784	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	85
PID 4412 wrote to memory of 1784	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	85
PID 4412 wrote to memory of 1784	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	85
PID 4412 wrote to memory of 1784	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	85
PID 4412 wrote to memory of 1784	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	85
PID 4412 wrote to memory of 1784	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	85
PID 4412 wrote to memory of 1784	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	85
PID 4412 wrote to memory of 2696	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	86
PID 4412 wrote to memory of 2696	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	86
PID 4412 wrote to memory of 2696	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	86
PID 4412 wrote to memory of 2696	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	86
PID 4412 wrote to memory of 2696	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	86
PID 4412 wrote to memory of 2696	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	86
PID 4412 wrote to memory of 2696	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	86
PID 4412 wrote to memory of 1248	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	87
PID 4412 wrote to memory of 1248	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	87
PID 4412 wrote to memory of 1248	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	87
PID 4412 wrote to memory of 1248	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	87
PID 4412 wrote to memory of 1248	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	87
PID 4412 wrote to memory of 1248	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	87
PID 4412 wrote to memory of 1248	4412	0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe	87

C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
"C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"
  2⤵
  PID:3616
- C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"
  2⤵
  PID:1784
- C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"
  2⤵
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"
  2⤵
  PID:1248
- C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"
  2⤵
  PID:3648
- C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"
  2⤵
  PID:4592
- C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"
  2⤵
  PID:1456
- C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"
  2⤵
  PID:3912
- C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"
  2⤵
  PID:4644
- C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"
  2⤵
  PID:2908
- C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"
  2⤵
  PID:2756
- C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b.exe"
  2⤵
  PID:1356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-14-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1248-13-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1248-15-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1784-6-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1784-8-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1784-7-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2696-9-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2696-16-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2696-11-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2696-10-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3616-3-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3616-4-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3616-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3616-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4412-17-0x0000000140000000-0x000000014013A000-memory.dmp

Download

memory/4412-0-0x0000000140000000-0x000000014013A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads