Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/11/2026, 03:41
General
- Target 2026-11-08_53821e9de9771292f40eb9bd292e7754_dcrat_glassworm_krakenkeylogger_poet-rat_quasar-rat.exe
- Size 29.3MB
- Sample261109-d876rawxat
- SHA256 07c4d59b4e514c2fd211c2607065bea3796cba08f49194da7a1c3f72422ceeea
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 2 IoCs
- Custom signatureDetects encrypted or obfuscated .NET executables 2 IoCs
- Custom signatureDetects executables manipulated with Fody 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-08_53821e9de9771292f40eb9bd292e7754_dcrat_glassworm_krakenkeylogger_poet-rat_quasar-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-08_53821e9de9771292f40eb9bd292e7754_dcrat_glassworm_krakenkeylogger_poet-rat_quasar-rat.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-11-08_53821e9de9771292f40eb9bd292e7754_dcrat_glassworm_krakenkeylogger_poet-rat_quasar-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-08_53821e9de9771292f40eb9bd292e7754_dcrat_glassworm_krakenkeylogger_poet-rat_quasar-rat.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2940-0-0x0000000140000000-0x0000000141D7D000-memory.dmp
memory/2940-3-0x0000000140000000-0x0000000141D7D000-memory.dmp
memory/4592-1-0x0000000140000000-0x0000000140015000-memory.dmp
memory/4592-2-0x0000000140000000-0x0000000140015000-memory.dmp