darksiderat | 48739068acf2e6d3fa0a6cb87dbbc1bb6a128bbf76942fdca3e1ba9e49029f03

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 06:07

Target
2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe
Size 695KB
Sample261109-gt99cach78
SHA256 48739068acf2e6d3fa0a6cb87dbbc1bb6a128bbf76942fdca3e1ba9e49029f03
MD5 2b8c17b6c1d1df2399e727571c5a8b8c
SHA1 698ffd1389d457a821210c84dd62ea5c57f25b08
SHA512 e462a71285be4654b3de6ad8a4623dcc18452cd6527f200deab7b35d293bb36ed42a1734ca557e6f7dd6e282ab1b7c67de62f48397b714bd6966a83fb9176525
SSDEEP 6144:RvjEfVVKNNV6PxpmJcUTZrb3ug2zWoSYQXdChNxF+cc8h3WWWWWW5PWWWWWWWWWZ:R1qycUt7lN9yNxFbht4I87E
TLSH
T16EE47C51BB497FA9D02ACD3C817585639D327C870B21ACEF12D472682F76AE71E39E10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 4 IoCs

resource	yara_rule
behavioral2/memory/5368-3-0x0000000140000000-0x0000000140010000-memory.dmp	family_darksiderat
behavioral2/memory/5368-5-0x0000000140000000-0x0000000140010000-memory.dmp	family_darksiderat
behavioral2/memory/1388-4-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1388-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 624 set thread context of 1388	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	88
PID 624 set thread context of 5368	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	89

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 1388	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	88
PID 624 wrote to memory of 1388	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	88
PID 624 wrote to memory of 1388	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	88
PID 624 wrote to memory of 1388	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	88
PID 624 wrote to memory of 1388	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	88
PID 624 wrote to memory of 1388	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	88
PID 624 wrote to memory of 1388	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	88
PID 624 wrote to memory of 5368	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	89
PID 624 wrote to memory of 5368	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	89
PID 624 wrote to memory of 5368	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	89
PID 624 wrote to memory of 5368	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	89
PID 624 wrote to memory of 5368	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	89
PID 624 wrote to memory of 5368	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	89
PID 624 wrote to memory of 5368	624	2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Local\Temp\2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe"
  2⤵
  PID:1388
- C:\Users\Admin\AppData\Local\Temp\2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-08_2b8c17b6c1d1df2399e727571c5a8b8c_cobalt-strike_icedid.exe"
  2⤵
  PID:5368

memory/624-0-0x0000000140000000-0x00000001400C0000-memory.dmp

Download

memory/624-6-0x0000000140000000-0x00000001400C0000-memory.dmp

Download

memory/1388-4-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1388-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5368-3-0x0000000140000000-0x0000000140010000-memory.dmp

Download

memory/5368-5-0x0000000140000000-0x0000000140010000-memory.dmp

Download