darksiderat | 5cabba931f7a5b8905786792d71c164b81622d78a58089715ecdb6525e5e03bb

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/11/2026, 06:43

Target
2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 520KB
Sample261106-hg28msbb99
SHA256 5cabba931f7a5b8905786792d71c164b81622d78a58089715ecdb6525e5e03bb
MD5 dcd66869be3fe7790c50d797e114f16b
SHA1 24552ac026b8b6b184d5d838ef64d953996ca7d3
SHA512 b55eccaef9210027ba99be4d245cacde8a188b844959655f3f01891c80ff275466a9a0ded62e59ea910434b229bf5ae700e22e694b42724c902b7fc5864b3b4d
SSDEEP 6144:V/kHlmA9J4gr5RV0nIdguOPVI2rIxpX1fLo+NZy/KWZaYvEV1:V/2mA9ygrfGXu8IxT0+NZJYv
TLSH
T1C8B46B90A3E401E8F1B79A35CD664512DA767C5A1B60DECF03A4666A1F33BD18D3CF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/2824-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2824-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5060 set thread context of 2824	5060	2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4112	javaws.exe
4112	javaws.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 4112	5060	2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	91
PID 5060 wrote to memory of 2824	5060	2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 5060 wrote to memory of 2824	5060	2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 5060 wrote to memory of 2824	5060	2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 5060 wrote to memory of 2824	5060	2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 5060 wrote to memory of 2824	5060	2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 5060 wrote to memory of 2824	5060	2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 5060 wrote to memory of 2824	5060	2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
  2⤵
  PID:2824
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-11-05_dcd66869be3fe7790c50d797e114f16b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112

memory/2824-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2824-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5060-0-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/5060-3-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/5060-4-0x0000000140000000-0x00000001400A9000-memory.dmp

Download