darksiderat | f80491353125e159fcc4761258b505d793e0c8f3a5b47a3928b53ce80ce6151c

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/11/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 704KB
Sample261105-a2en3sg13p
SHA256 f80491353125e159fcc4761258b505d793e0c8f3a5b47a3928b53ce80ce6151c
MD5 2f3ce2c790315219bc27565d8d1779ab
SHA1 fc8c45515fe9fe44ea3ebb62fd5bbbe049b538c0
SHA512 f743e7cfae998a6ffc3c3afea1a565fffa1d1c0ab2f538f388508a85edd1bfda78988dcdd69a80ce03ddb407976e588e3a78b694ad058d6bc9b053b46ebe51b2
SSDEEP 12288:KOPGZhRJmmE8jMtOdb26d8XUdO0vzmElHBAO0vzmEl:ih3mgMc/dRdFzzHyFzz
TLSH
T122E4E00BEF9621E9E07EC578C4915867E761B82907D0EBDF1B8049A30E72AD09F3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/1684-6-0x0000000140000000-0x0000000140013000-memory.dmp	family_darksiderat
behavioral2/memory/1684-3-0x0000000140000000-0x0000000140013000-memory.dmp	family_darksiderat
behavioral2/files/0x000c00000001c5ec-24.dat	family_darksiderat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Executes dropped EXE 1 IoCs

pid	Process
5056	ox_1793839334666.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3564 set thread context of 4516	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 3564 set thread context of 1684	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 3564 set thread context of 2412	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	92

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ox_1793839334666.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ox_1793839334666.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4516	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 3564 wrote to memory of 4516	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 3564 wrote to memory of 4516	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 3564 wrote to memory of 4516	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 3564 wrote to memory of 4516	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 3564 wrote to memory of 4516	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 3564 wrote to memory of 4516	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 3564 wrote to memory of 1684	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 3564 wrote to memory of 1684	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 3564 wrote to memory of 1684	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 3564 wrote to memory of 1684	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 3564 wrote to memory of 1684	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 3564 wrote to memory of 1684	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 3564 wrote to memory of 1684	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 3564 wrote to memory of 1684	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 3564 wrote to memory of 2412	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 3564 wrote to memory of 2412	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 3564 wrote to memory of 2412	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 3564 wrote to memory of 2412	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 3564 wrote to memory of 2412	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 3564 wrote to memory of 2412	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 3564 wrote to memory of 2412	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 3564 wrote to memory of 2844	3564	2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	93
PID 2844 wrote to memory of 5056	2844	cmd.exe	95
PID 5056 wrote to memory of 1888	5056	ox_1793839334666.exe	96
PID 5056 wrote to memory of 1888	5056	ox_1793839334666.exe	96
PID 5056 wrote to memory of 1888	5056	ox_1793839334666.exe	96
PID 5056 wrote to memory of 1888	5056	ox_1793839334666.exe	96
PID 5056 wrote to memory of 1888	5056	ox_1793839334666.exe	96
PID 5056 wrote to memory of 1888	5056	ox_1793839334666.exe	96
PID 5056 wrote to memory of 1888	5056	ox_1793839334666.exe	96
PID 5056 wrote to memory of 1888	5056	ox_1793839334666.exe	96
PID 5056 wrote to memory of 1888	5056	ox_1793839334666.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  PID:4516
- C:\Users\Admin\AppData\Local\Temp\2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  PID:1684
- C:\Users\Admin\AppData\Local\Temp\2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-03_2f3ce2c790315219bc27565d8d1779ab_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  PID:2412
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1793839334666.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\ox_1793839334666.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1793839334666.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Windows\System32\LegacyNetUXHost.exe
      "C:\Windows\System32\LegacyNetUXHost.exe"
      4⤵
      PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a84e0a343fcfe7a08b86e72354464f2538c282699bd60a1353105d57031a67c6
MD5 ab85fe5aab8e0b81a1157c2d965f6121
SHA1 b769c46f9a2774062573443467a6379a02c9aa27
SHA512 1bad97c337c0e943a20fc650e5830dd0f08cdb2424e5e3e227742837d7efb58f23ff7e090133a151bbcc58ecad561c07fd9b0672f6a991691fac688ed07f300b
TLSH
T10CC08C1C2AA60A16F2A8437D02D179039B208101E2418F451AF13A48C996B162C38C2A
MD5 SHA1 SHA512 TLSH

Submit Download

Retev[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U8AUWZTD\Retev[1].htm
Size 56KB
SHA256 0d0a91c58d930d76a2600f1b75965a4edfb63357284c5965fb3b3f08266f0237
MD5 68ddf5f041cc9d80252e243352728396
SHA1 fb5c316bd6f4411aec73516adb311624e707d83b
SHA512 9f9a0bc1bc25f6eea49ed3f9a9e0025562ff6865e06d6c08917b182c8017aa3afecd23ea4a622e713a0430909b8dd992d0a9b33e97c8e4e7b8edba16f7c3463c
SSDEEP 768:Eb9OnCKoatcLZBTjwFrECxGazpOWp54vg5d5YP98yxA1XbXP7kW7rCVr8Z0kP:I9vatZ5tsWp0g5rBSmLYW7rCVoekP
TLSH
T13043F834EA5AB06FD35ED834DD430D16CD12BCCA97A0BB9B57915CD20EAAF209B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1684-6-0x0000000140000000-0x0000000140013000-memory.dmp

Download

memory/1684-3-0x0000000140000000-0x0000000140013000-memory.dmp

Download

memory/1888-70-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-58-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-65-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-62-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-64-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-47-0x0000027473380000-0x0000027473381000-memory.dmp

Download

memory/1888-46-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-53-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-60-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-61-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-59-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-66-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-63-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-69-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-71-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-72-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-67-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/1888-68-0x0000027472C60000-0x0000027473379000-memory.dmp

Download

memory/2412-5-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3564-0-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/3564-37-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/4516-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4516-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads