darksiderat | 3afa43a45a68a0bef45b4154d8e66ecb316d34ed875e9cb6499608ec8bb137a5

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 13:33

Target
2026-11-11_1288e957deb5b373685f1cdb293d60fb_akira_glassworm_icedid_rusty-stealer.exe
Size 5.2MB
Sample261111-qtpgbahg67
SHA256 3afa43a45a68a0bef45b4154d8e66ecb316d34ed875e9cb6499608ec8bb137a5
MD5 1288e957deb5b373685f1cdb293d60fb
SHA1 d5da63aebcaf85052490a4403bc6550c0a9f97e9
SHA512 a915c53ec0aa9c1559712e04de5264843dfd808e8fea5f908a4877bcd6c89954b9cdb4a1d755602f31beeef017df650dbc2c049f8ffaa0896dbb3f80b9b00cb9
SSDEEP 49152:ie5uCataB/skUkA6ZoO9uB/rmCtKzVHwMJVbN2b3qvX9Flg0CBwQq0rroZklb/:VuC51F0foZk
TLSH
T183463912BB9758EDC46AC070834A46739B71B4CA0B35BAFF45C482352F6AAF41F78758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4240-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4240-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4636 set thread context of 4240	4636	2026-11-11_1288e957deb5b373685f1cdb293d60fb_akira_glassworm_icedid_rusty-stealer.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4240	4636	2026-11-11_1288e957deb5b373685f1cdb293d60fb_akira_glassworm_icedid_rusty-stealer.exe	90
PID 4636 wrote to memory of 4240	4636	2026-11-11_1288e957deb5b373685f1cdb293d60fb_akira_glassworm_icedid_rusty-stealer.exe	90
PID 4636 wrote to memory of 4240	4636	2026-11-11_1288e957deb5b373685f1cdb293d60fb_akira_glassworm_icedid_rusty-stealer.exe	90
PID 4636 wrote to memory of 4240	4636	2026-11-11_1288e957deb5b373685f1cdb293d60fb_akira_glassworm_icedid_rusty-stealer.exe	90
PID 4636 wrote to memory of 4240	4636	2026-11-11_1288e957deb5b373685f1cdb293d60fb_akira_glassworm_icedid_rusty-stealer.exe	90
PID 4636 wrote to memory of 4240	4636	2026-11-11_1288e957deb5b373685f1cdb293d60fb_akira_glassworm_icedid_rusty-stealer.exe	90
PID 4636 wrote to memory of 4240	4636	2026-11-11_1288e957deb5b373685f1cdb293d60fb_akira_glassworm_icedid_rusty-stealer.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-11_1288e957deb5b373685f1cdb293d60fb_akira_glassworm_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_1288e957deb5b373685f1cdb293d60fb_akira_glassworm_icedid_rusty-stealer.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\2026-11-11_1288e957deb5b373685f1cdb293d60fb_akira_glassworm_icedid_rusty-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-11_1288e957deb5b373685f1cdb293d60fb_akira_glassworm_icedid_rusty-stealer.exe"
  2⤵
  PID:4240

memory/4240-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4240-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4636-0-0x0000000140000000-0x000000014054C000-memory.dmp

Download

memory/4636-3-0x0000000140000000-0x000000014054C000-memory.dmp

Download