darksiderat | d3945a3b14ee0b7cf3775f8515a1c5a08b1f10533ee6e5cfbb9bccb352172f8c

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 13:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 3.7MB
Sample261104-qwd4cs11ct
SHA256 d3945a3b14ee0b7cf3775f8515a1c5a08b1f10533ee6e5cfbb9bccb352172f8c
MD5 93e85b9f101abe2cd42955ea0befec05
SHA1 b4ac76b3d2d387e9a86b5d24c78444f46f02e3a3
SHA512 08757d87a4eb4a197eca084db3c67f402534454b8d2b391ff096e0ad24026d0d13d8a5fc624d22edfb03d9a543f99cc3db980ed95f98d078ddbeabda75eace15
SSDEEP 49152:WAna/MloRuTxHorZ984+oEqEJ+RuDdh4AUIYkJSmsoFjT2piPqfVgqFXoBFX:ntZCDhuALQJS5QgFfVg
TLSH
T1E0069D56E7B800E8D9BBD138C9564517E7F2B8141362DBCF07A04AAA1F23BE51E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/1832-3-0x0000000140000000-0x0000000140013000-memory.dmp	family_darksiderat
behavioral2/memory/1832-4-0x0000000140000000-0x0000000140013000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2800 set thread context of 2416	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	88
PID 2800 set thread context of 1832	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	89

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2416	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	88
PID 2800 wrote to memory of 2416	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	88
PID 2800 wrote to memory of 2416	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	88
PID 2800 wrote to memory of 2416	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	88
PID 2800 wrote to memory of 2416	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	88
PID 2800 wrote to memory of 2416	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	88
PID 2800 wrote to memory of 2416	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	88
PID 2800 wrote to memory of 1832	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	89
PID 2800 wrote to memory of 1832	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	89
PID 2800 wrote to memory of 1832	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	89
PID 2800 wrote to memory of 1832	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	89
PID 2800 wrote to memory of 1832	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	89
PID 2800 wrote to memory of 1832	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	89
PID 2800 wrote to memory of 1832	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	89
PID 2800 wrote to memory of 1832	2800	2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
  2⤵
  PID:2416
- C:\Users\Admin\AppData\Local\Temp\2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-03_93e85b9f101abe2cd42955ea0befec05_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
  2⤵
  PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-3-0x0000000140000000-0x0000000140013000-memory.dmp

Download

memory/1832-4-0x0000000140000000-0x0000000140013000-memory.dmp

Download

memory/2416-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2416-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2800-0-0x0000000140000000-0x0000000140420000-memory.dmp

Download

memory/2800-5-0x0000000140000000-0x0000000140420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads