darksiderat | 8d4ec4f51e2e82fc0d3aeb385a07b35796cd60c8f75c7d4587b6d4d64b6818f6

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 21:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_402d1b507cbdb413037859424e6780a0_akira_icedid_rusty-stealer.exe
Size 1.5MB
Sample261110-1ncwfabe68
SHA256 8d4ec4f51e2e82fc0d3aeb385a07b35796cd60c8f75c7d4587b6d4d64b6818f6
MD5 402d1b507cbdb413037859424e6780a0
SHA1 613330313692dc696faf2423c1f2afe92a4b3d46
SHA512 44f2da3da53cb2ece2ccdd08b93e4a85a7d4e74c5f51f0c705a75db9d24e50a38977b406d815ede5595b0bd5355cfc055c63dce8731171867920e083d8adeb28
SSDEEP 24576:2uhTPi1jxBgKehqiUxqBX5GO/YxdPH43Vcm2x:2OTPi19ehqiUopGOkdPHgVcm2x
TLSH
T19B652A516BB94968C09AC874C24AABA74A2134CF0B36B5AF0FC515257FFE6F41F2D207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5ab-18.dat	family_darksiderat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	3240	2026-11-09_402d1b507cbdb413037859424e6780a0_akira_icedid_rusty-stealer.exe

Executes dropped EXE 1 IoCs

pid	Process
2096	ox_1794347250635.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3484	icacls.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_402d1b507cbdb413037859424e6780a0_akira_icedid_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_402d1b507cbdb413037859424e6780a0_akira_icedid_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ox_1794347250635.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ox_1794347250635.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3240	2026-11-09_402d1b507cbdb413037859424e6780a0_akira_icedid_rusty-stealer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3240	2026-11-09_402d1b507cbdb413037859424e6780a0_akira_icedid_rusty-stealer.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 2940	3240	2026-11-09_402d1b507cbdb413037859424e6780a0_akira_icedid_rusty-stealer.exe	90
PID 2940 wrote to memory of 2096	2940	cmd.exe	92
PID 2096 wrote to memory of 3484	2096	ox_1794347250635.exe	94
PID 2096 wrote to memory of 3484	2096	ox_1794347250635.exe	94
PID 2096 wrote to memory of 3484	2096	ox_1794347250635.exe	94
PID 2096 wrote to memory of 3484	2096	ox_1794347250635.exe	94
PID 2096 wrote to memory of 3484	2096	ox_1794347250635.exe	94
PID 2096 wrote to memory of 3484	2096	ox_1794347250635.exe	94
PID 2096 wrote to memory of 3484	2096	ox_1794347250635.exe	94
PID 2096 wrote to memory of 3484	2096	ox_1794347250635.exe	94
PID 2096 wrote to memory of 3484	2096	ox_1794347250635.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-11-09_402d1b507cbdb413037859424e6780a0_akira_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_402d1b507cbdb413037859424e6780a0_akira_icedid_rusty-stealer.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1794347250635.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\ox_1794347250635.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1794347250635.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe"
      4⤵
      Modifies file permissions
      PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 694b848ee82d540fabb71bd3c63929c23d7ec90172adc67785c5016cc3ee399b
MD5 6e8b596a0154fdd8568c7e7d718067eb
SHA1 c4ec0be48d70f1d50c7947503b97e28461118d52
SHA512 ead50b45e3bdcc5f021c5909001cfee6758bd2c8378582df5662d68a96ef1a437c505e578bb4087976e93b84b639957bafa46ac9c38f653864e55d1def7db777
TLSH
T1ECC08C2C2AA20A16F2A8437C02C13E439B208101E241CF061AF13A48C996B163D38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

Retev[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QG8FQWMQ\Retev[1].htm
Size 56KB
SHA256 999ec76c0eb8fdeebd7d9583eed68c4acf7b983e6d08e086a9bf6f6d81e0f1bd
MD5 e950167b7fb0845be10113967d330d26
SHA1 f6d9c02971073396fd615bb95209f45c022fdebd
SHA512 c89191d2f8c90b7d4c43616b1ec9bd5040953c3042f78b9ad13f96fbe4e6cb433d10cae2c729da29fcee96878a11c7cd17055998c1cf1e1c215328c43a9dbafb
SSDEEP 768:7b8CDi1y33B6H78VNAfRQvpJcOMhcKPPzEOWp54vg5d5YP98yxA1XbXNMkW7rCV0:XD6H78vcjHWp0g5rBSmhJW7rCVoekP
TLSH
T15C430935EA5EB06FD359C834DD470D06CE12BCCA9AA4BB9B57910CD20DEAF609B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3240-52-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3240-0-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3484-65-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-63-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-39-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-54-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-60-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-40-0x0000020343C80000-0x0000020343C81000-memory.dmp

Download

memory/3484-62-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-66-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-64-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-46-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-61-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-59-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-58-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-56-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-55-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-53-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-51-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

memory/3484-57-0x0000020343560000-0x0000020343C79000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads