Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/11/2026, 07:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe
- Size 1.5MB
- Sample261114-hx6wrset2t
- SHA256 fa3a5aa1c66ea6e2143225ef50968c6a89246515df77e85ecbf8839ca44adf27
- MD5 a853764d4dcc4ff08c11f87ac165eb19
- SHA1 4c30eff0e442dcca3e6f931b4ce34d29271b6ece
- SHA512 f31888039e0b0d9f29b7cfcc7b031f48dae36985172b17343386b6deeb9546016e6802bbd6adcc57557e258fa6272911e419c85218f658a4f9a7eac470633292
- SSDEEP 24576:WoUt7lN9yNlkJoxWnHUskJoxWnHU1kJoxWnHU:WoUt7lulMNM8M
- TLSH T18F65D001EF857FA9D07ACC7C86758563AD727C8A0B21E8EF12C072551E766E72A39F10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 5 IoCs
resource yara_rule behavioral2/memory/4104-15-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/1452-14-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/2956-12-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/4164-4-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/4164-2-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat - Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 3604 set thread context of 4164 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 88 PID 3604 set thread context of 4104 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 94 PID 3604 set thread context of 3116 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 90 PID 3604 set thread context of 4260 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 91 PID 3604 set thread context of 2956 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 92 PID 3604 set thread context of 932 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 93 PID 3604 set thread context of 1452 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 89 - Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 3604 wrote to memory of 4164 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 88 PID 3604 wrote to memory of 4164 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 88 PID 3604 wrote to memory of 4164 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 88 PID 3604 wrote to memory of 4164 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 88 PID 3604 wrote to memory of 4164 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 88 PID 3604 wrote to memory of 4164 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 88 PID 3604 wrote to memory of 4164 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 88 PID 3604 wrote to memory of 4104 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 94 PID 3604 wrote to memory of 4104 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 94 PID 3604 wrote to memory of 4104 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 94 PID 3604 wrote to memory of 4104 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 94 PID 3604 wrote to memory of 4104 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 94 PID 3604 wrote to memory of 4104 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 94 PID 3604 wrote to memory of 4104 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 94 PID 3604 wrote to memory of 3116 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 90 PID 3604 wrote to memory of 3116 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 90 PID 3604 wrote to memory of 3116 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 90 PID 3604 wrote to memory of 3116 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 90 PID 3604 wrote to memory of 3116 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 90 PID 3604 wrote to memory of 3116 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 90 PID 3604 wrote to memory of 3116 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 90 PID 3604 wrote to memory of 3116 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 90 PID 3604 wrote to memory of 4260 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 91 PID 3604 wrote to memory of 4260 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 91 PID 3604 wrote to memory of 4260 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 91 PID 3604 wrote to memory of 4260 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 91 PID 3604 wrote to memory of 4260 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 91 PID 3604 wrote to memory of 4260 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 91 PID 3604 wrote to memory of 4260 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 91 PID 3604 wrote to memory of 4260 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 91 PID 3604 wrote to memory of 2956 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 92 PID 3604 wrote to memory of 2956 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 92 PID 3604 wrote to memory of 2956 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 92 PID 3604 wrote to memory of 2956 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 92 PID 3604 wrote to memory of 2956 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 92 PID 3604 wrote to memory of 2956 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 92 PID 3604 wrote to memory of 2956 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 92 PID 3604 wrote to memory of 932 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 93 PID 3604 wrote to memory of 932 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 93 PID 3604 wrote to memory of 932 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 93 PID 3604 wrote to memory of 932 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 93 PID 3604 wrote to memory of 932 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 93 PID 3604 wrote to memory of 932 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 93 PID 3604 wrote to memory of 932 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 93 PID 3604 wrote to memory of 932 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 93 PID 3604 wrote to memory of 1452 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 89 PID 3604 wrote to memory of 1452 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 89 PID 3604 wrote to memory of 1452 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 89 PID 3604 wrote to memory of 1452 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 89 PID 3604 wrote to memory of 1452 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 89 PID 3604 wrote to memory of 1452 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 89 PID 3604 wrote to memory of 1452 3604 2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"2⤵PID:4164
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"2⤵PID:1452
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"2⤵PID:3116
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"2⤵PID:4260
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"2⤵PID:2956
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"2⤵PID:932
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_a853764d4dcc4ff08c11f87ac165eb19_icedid.exe"2⤵PID:4104
-