darksiderat | 9f4b547c92ce2989ff32987566075987daef8e081dfea67ebdd03e5a8c138f65

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/11/2026, 03:44

Target
2026-11-04_fc5532bab6dfd377d6c85b332a6892d9_cobalt-strike_icedid.exe
Size 664KB
Sample261105-eal2asfe32
SHA256 9f4b547c92ce2989ff32987566075987daef8e081dfea67ebdd03e5a8c138f65
MD5 fc5532bab6dfd377d6c85b332a6892d9
SHA1 53533fcddd78f6aa257e6e9d6e9c0e2d3f67f7fb
SHA512 0d5ba44f57eeadbed6bfddf805bb91648a515095978461d37b49a3f44561d91fe5c5433dab6eca57973425a8045493b26724528141083097e314275e394dcd83
SSDEEP 6144:dvjEfVVKNNV6PxpmJcUTZrb3ug2zWoSYQXdChNxF+cc8h3WWWWWW5PWWWWWWWWWo:d1qycUt7lN9yNxFbht4
TLSH
T133E45C51BB49BFE9D066CD3C817585639D327C870B21A8EF12D432682F76AE71E39E10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/3712-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3712-3-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5856 set thread context of 3712	5856	2026-11-04_fc5532bab6dfd377d6c85b332a6892d9_cobalt-strike_icedid.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 3712	5856	2026-11-04_fc5532bab6dfd377d6c85b332a6892d9_cobalt-strike_icedid.exe	89
PID 5856 wrote to memory of 3712	5856	2026-11-04_fc5532bab6dfd377d6c85b332a6892d9_cobalt-strike_icedid.exe	89
PID 5856 wrote to memory of 3712	5856	2026-11-04_fc5532bab6dfd377d6c85b332a6892d9_cobalt-strike_icedid.exe	89
PID 5856 wrote to memory of 3712	5856	2026-11-04_fc5532bab6dfd377d6c85b332a6892d9_cobalt-strike_icedid.exe	89
PID 5856 wrote to memory of 3712	5856	2026-11-04_fc5532bab6dfd377d6c85b332a6892d9_cobalt-strike_icedid.exe	89
PID 5856 wrote to memory of 3712	5856	2026-11-04_fc5532bab6dfd377d6c85b332a6892d9_cobalt-strike_icedid.exe	89
PID 5856 wrote to memory of 3712	5856	2026-11-04_fc5532bab6dfd377d6c85b332a6892d9_cobalt-strike_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-04_fc5532bab6dfd377d6c85b332a6892d9_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-04_fc5532bab6dfd377d6c85b332a6892d9_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Users\Admin\AppData\Local\Temp\2026-11-04_fc5532bab6dfd377d6c85b332a6892d9_cobalt-strike_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-04_fc5532bab6dfd377d6c85b332a6892d9_cobalt-strike_icedid.exe"
  2⤵
  PID:3712

memory/3712-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3712-3-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5856-1-0x0000000140000000-0x00000001400B8000-memory.dmp

Download

memory/5856-4-0x0000000140000000-0x00000001400B8000-memory.dmp

Download