darksiderat | 4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
Size 10.0MB
Sample261107-pm6xcaeh66
SHA256 4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a
MD5 5efa4447693b21e5b5709c2ad4a86775
SHA1 137e1fc182e81db3306c99b4cda17d8f26f9936d
SHA512 c34b9dc916125fd6a5418f3d749da41ab592cd39464c130cd99c7448a89ad0080b4e37609b0ad886e21e13ac925aa86b66b0cd948a5e97bcf95853fdd2889362
SSDEEP 196608:dQ90W8UAfdurH0D9BKG+5fc2S/ErXKEtw+J4Jkz9Rwpr2Zwl6RoFmuPMsqfNmI:dlW8/duQDvV+53SM8+JLwqgkDl
TLSH
T1E4B633887FD509E8E8ABF23ED4D088666391751207E5CA875BF45D220DB32D8FD31B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/4088-4-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4088-3-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2844-952-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Loads dropped DLL 10 IoCs

pid	Process
6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4100 set thread context of 4088	4100	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	89
PID 6124 set thread context of 2844	6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	91

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 4088	4100	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	89
PID 4100 wrote to memory of 4088	4100	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	89
PID 4100 wrote to memory of 4088	4100	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	89
PID 4100 wrote to memory of 4088	4100	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	89
PID 4100 wrote to memory of 4088	4100	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	89
PID 4100 wrote to memory of 4088	4100	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	89
PID 4100 wrote to memory of 4088	4100	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	89
PID 4100 wrote to memory of 6124	4100	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	90
PID 6124 wrote to memory of 2844	6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	91
PID 6124 wrote to memory of 2844	6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	91
PID 6124 wrote to memory of 2844	6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	91
PID 6124 wrote to memory of 2844	6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	91
PID 6124 wrote to memory of 2844	6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	91
PID 6124 wrote to memory of 2844	6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	91
PID 6124 wrote to memory of 2844	6124	4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe	91

C:\Users\Admin\AppData\Local\Temp\4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
"C:\Users\Admin\AppData\Local\Temp\4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Temp\4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
  "C:\Users\Admin\AppData\Local\Temp\4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe"
  2⤵
  PID:4088
- C:\Users\Admin\AppData\Local\Temp\4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
  "C:\Users\Admin\AppData\Local\Temp\4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Users\Admin\AppData\Local\Temp\4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe
    "C:\Users\Admin\AppData\Local\Temp\4a48fec4303975e17e53a774c1b5c0e266874cd6c856eefbd18e360c612db06a.exe"
    3⤵
    PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41002\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41002\_bz2.pyd
Size 83KB
SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
MD5 ed9f4c1cf33db08cac3c7ba7a973e61b
SHA1 b0db47ca7be3df00d1585fdabe13fb983cfed04d
SHA512 dc5f79944f9acf910d4af892d8a7c2368d2de29bf8ade2feecb056b2b3416d55bd22aacd16a7dc4488c4a1a5682409430f6f210e7396af4f14fd5f307ba1926c
SSDEEP 1536:OZ5Az7KPZG1uDiYhGlHjecH7rYiUO18aBso6lIyLVryrcz89SfIie:mWzdMiYQzrAO6aCo6lIyLV1cZ
TLSH
T115839E82F39967F2F49B81B546C10757F770BA51075093AFF288C2952F03B91AE6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41002\_ctypes.pyd
Size 129KB
SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
MD5 ab19e3dd4731ed075589abadcde68991
SHA1 b51ed4059d7d0ec7cbd5b34767e310bdee9cb4d4
SHA512 6aa9cb0e5cc9514d71bf7a2ab21d24a3fd5ef0eb0f0e7bf26a4a807914c7a3cadf73e1bd6cdd9f31d8594b72272eaccc79632f9dfd9534da5c8217d0eb0e9cda
SSDEEP 3072:oNxNJni/7u3vSKflXTf/FIBIQ0Jr3rc1mAj5IyyPhnIH:a7ni/7IvBjf/FIWQ2r3I1mqvH
TLSH
T115D38D0B775800AADAA79178C573AF47DBF1B453161187CF02A4C69A2F637936E7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41002\_lzma.pyd
Size 156KB
SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
MD5 d165b7b9a127f66704ceaa196be319e5
SHA1 ee3de55b32d1357599cef86df35e307477038a15
SHA512 b99214ce14899656f9c0fd23b219d06de383aff95b344def145a9304c47e41b1645bd3544f4fb83ac070d42951de228873a99feb98948910fdd0e7fcc54a3122
SSDEEP 3072:r0Vfr5vC9v2J2dE2AowznfB9mNouhD28ztJLlIy01nF7qV:rSr5YBW5YOufpJL49y
TLSH
T142F35C86B794F0E6F7728C38D6624F57E7F5781A0310929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41002\_tkinter.pyd
Size 67KB
SHA256 574549683a4298335bdb8761ec6eaa11d56e366b618b5ab0b701b5fe2dda48aa
MD5 3aa9cd197097575a1cd85c4b60b1489c
SHA1 973644b7c6c66e0c0ac0bb6f82600c1e62669ab8
SHA512 b616be273ac160f3c344fee6506f3f90948aa2fb12ac09da5a02e3ef8292614d7257a91b5607978675905ee377aef0640e75d43b5ed70d3799313a6793f17607
SSDEEP 1536:mxIxVo3bb7sOOkQ48jV3RNEFlU9ow9oVZfd2TkR9IyvSLyrcz893fITZ+7:maerFQfulPdVZF/9IyvSVvk
TLSH
T1AD638E9BA7A4008BEEE3D539C4739B13E575B6924A14924F01E4D34A2F333D3E7AA714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI41002\base_library.zip
Size 1.3MB
SHA256 91ad415b624befff2fc483e21570f2c21c328ddaa3d9e92428d3851f3cf5ac15
MD5 b93f5dd086e7513508f7b0ba14f9a6ff
SHA1 9a63de7e16339f51ae8967296916566df5ba720f
SHA512 e3d56c827addc441a8084448d1f9f5dcf0748efef098ad5947ff41e573460f1a93bb9280c4e38f16ac92909bb31120dfbc8ef0df59b5eb563909230b3f6319f8
SSDEEP 12288:ntYzGNcT1IzwtDuOBa80201jwCVRDVoioSYBDL+DsXi2cPPdxhYLO6OdjdTUHyCl:6SeT1IzGzp5cPPdxhYLEdZ0qt7WpD
TLSH
T1D9551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41002\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41002\python313.dll
Size 5.8MB
SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
MD5 5acd4d4f35e13ef79c883ace05c4eaf5
SHA1 03a2944b87b8a6fe0bff5336978ed6558deda5a2
SHA512 f1bb13fac80f28e2419479ee14e41dbcba8fbdc0ca3698d01a8ccddf2bc2fe3a4cf90acf2fd42e4a2f1ec49751d0c66cbc7b59fb8a43fc4dcb7b892cae76e525
SSDEEP 98304:GlKJHA/wful8vHGtFjX/LTv4HDMiEJZIPcR:GlLhl8kDioIPcR
TLSH
T102568D16729E41ACC97B8078CA03864BFBB27C417FA0534B61E6BB5D2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41002\tcl86t.dll
Size 1.8MB
SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
MD5 fa83a807131f3d4a6070eb884e682ad1
SHA1 226bf1cd0fc289034d9579c95ee0fe4df50cc6b8
SHA512 6e86f3725bb68af581e3e1b917c950f255e0f4348256fc02d8a560159cd225fe28303da2554c205636f2f82b9757072bf0c3460116bd7b09ef0bf01cc46125a2
SSDEEP 49152:D0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGP:YBUqMR7i6x9T+P
TLSH
T1E6859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41002\tk86t.dll
Size 1.5MB
SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
MD5 0da8eb1421517029c8d986519b0e5c63
SHA1 daa8395b9d691b5dfbdaa1f63256555a14010891
SHA512 f729f812901cc023111989d6e1eaa639d2ed2283bdb852c91abc283dee3d785295d3191f70f2ef535d268d454279a7ddd0339993f06be21b62d43d8ab27d70af
SSDEEP 49152:A76DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezf5:VQchLNqaJvARxr9DrTwylL1y5BEq8JTW
TLSH
T16E755A06B2A0C198C66FA134C91796BAE7F17C05931057DB72A0BE697F73BD2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41002\zlib1.dll
Size 142KB
SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
MD5 eb3af30a0981219d851e6506db106bc2
SHA1 fd7b1b01dc01a7f32bd51f9a31bf717f4d55d09c
SHA512 8f55f4a86b747b5570d0f539c95dc1677eeba52bcd01850e8d86998b3415b99c92566ad9ece0e46b50e0e3a7eed6a4fe09604ec295f36f9bebf6e8f407ace468
SSDEEP 3072:0vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCoV:0sVD+RrFgvi7J9
TLSH
T1C8E37D9BA6E228BDC67780B052E78776F932B8214B309DEF5148C7741B12E506B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2844-952-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4088-3-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4088-4-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4100-49-0x0000000140000000-0x0000000140A0A000-memory.dmp

Download

memory/4100-971-0x0000000140000000-0x0000000140A0A000-memory.dmp

Download

memory/6124-947-0x0000000140000000-0x0000000140A0A000-memory.dmp

Download

memory/6124-970-0x0000000140000000-0x0000000140A0A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads