Analysis
- max time kernel
148s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/11/2026, 12:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe
- Size 1.9MB
- Sample261114-p4bsjazy2j
- SHA256 9bed557f7f92523569c0b3e6ca0e21562fdb8f697e50dbb10b4b037364cd54b5
- MD5 5cdb901926cf524cc7a46e72c2a5760d
- SHA1 ef9b4d9dd866944ff6981883693d12890ba01ca4
- SHA512 def9a3f75258e7f72426f373aa180db54b2973c76a3d4c44ede089e82bce35a1d4c5e015a31cbf0c7b76e60eb5395fb395e9cc9c1577f49ef0cc987bbc162cb5
- SSDEEP 24576:/mkBPtdnkJoxWnHUpkJoxWnHUWkJoxWnHUVkJoxWnHUMkJoxWnHU8kJoxWnHU:/DPtZMYMPMMMNMFM
- TLSH T12395F106EFA606E9D4BFC0798AA14167F672B8194360D7DBA7C1D6471F732E0AA3D700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 8 IoCs
resource yara_rule behavioral2/memory/4208-25-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/5576-20-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/2848-19-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/4572-16-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/3880-18-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/3728-2-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/1620-15-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat behavioral2/memory/3728-1-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat - Suspicious use of SetThreadContext 13 IoCs
description pid Process procid_target PID 4136 set thread context of 3728 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 89 PID 4136 set thread context of 4572 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 90 PID 4136 set thread context of 4556 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 91 PID 4136 set thread context of 2848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 92 PID 4136 set thread context of 5896 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 93 PID 4136 set thread context of 3880 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 94 PID 4136 set thread context of 3452 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 95 PID 4136 set thread context of 5576 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 96 PID 4136 set thread context of 848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 97 PID 4136 set thread context of 1620 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 98 PID 4136 set thread context of 4512 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 100 PID 4136 set thread context of 4208 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 101 PID 4136 set thread context of 3008 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 99 - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4136 wrote to memory of 3728 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 89 PID 4136 wrote to memory of 3728 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 89 PID 4136 wrote to memory of 3728 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 89 PID 4136 wrote to memory of 3728 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 89 PID 4136 wrote to memory of 3728 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 89 PID 4136 wrote to memory of 3728 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 89 PID 4136 wrote to memory of 3728 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 89 PID 4136 wrote to memory of 4572 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 90 PID 4136 wrote to memory of 4572 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 90 PID 4136 wrote to memory of 4572 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 90 PID 4136 wrote to memory of 4572 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 90 PID 4136 wrote to memory of 4572 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 90 PID 4136 wrote to memory of 4572 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 90 PID 4136 wrote to memory of 4572 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 90 PID 4136 wrote to memory of 2848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 92 PID 4136 wrote to memory of 2848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 92 PID 4136 wrote to memory of 2848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 92 PID 4136 wrote to memory of 2848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 92 PID 4136 wrote to memory of 2848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 92 PID 4136 wrote to memory of 2848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 92 PID 4136 wrote to memory of 2848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 92 PID 4136 wrote to memory of 4556 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 91 PID 4136 wrote to memory of 4556 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 91 PID 4136 wrote to memory of 4556 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 91 PID 4136 wrote to memory of 4556 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 91 PID 4136 wrote to memory of 4556 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 91 PID 4136 wrote to memory of 4556 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 91 PID 4136 wrote to memory of 4556 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 91 PID 4136 wrote to memory of 4556 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 91 PID 4136 wrote to memory of 5896 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 93 PID 4136 wrote to memory of 5896 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 93 PID 4136 wrote to memory of 5896 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 93 PID 4136 wrote to memory of 5896 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 93 PID 4136 wrote to memory of 5896 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 93 PID 4136 wrote to memory of 5896 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 93 PID 4136 wrote to memory of 5896 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 93 PID 4136 wrote to memory of 5896 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 93 PID 4136 wrote to memory of 3880 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 94 PID 4136 wrote to memory of 3880 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 94 PID 4136 wrote to memory of 3880 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 94 PID 4136 wrote to memory of 3880 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 94 PID 4136 wrote to memory of 3880 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 94 PID 4136 wrote to memory of 3880 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 94 PID 4136 wrote to memory of 3880 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 94 PID 4136 wrote to memory of 3452 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 95 PID 4136 wrote to memory of 5576 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 96 PID 4136 wrote to memory of 5576 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 96 PID 4136 wrote to memory of 5576 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 96 PID 4136 wrote to memory of 5576 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 96 PID 4136 wrote to memory of 5576 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 96 PID 4136 wrote to memory of 5576 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 96 PID 4136 wrote to memory of 5576 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 96 PID 4136 wrote to memory of 3452 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 95 PID 4136 wrote to memory of 3452 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 95 PID 4136 wrote to memory of 3452 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 95 PID 4136 wrote to memory of 3452 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 95 PID 4136 wrote to memory of 3452 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 95 PID 4136 wrote to memory of 3452 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 95 PID 4136 wrote to memory of 3452 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 95 PID 4136 wrote to memory of 848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 97 PID 4136 wrote to memory of 848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 97 PID 4136 wrote to memory of 848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 97 PID 4136 wrote to memory of 848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 97 PID 4136 wrote to memory of 848 4136 2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"2⤵PID:3728
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"2⤵PID:4572
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"2⤵PID:4556
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"2⤵PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"2⤵PID:5896
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"2⤵PID:3880
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"2⤵PID:3452
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"2⤵PID:5576
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"2⤵PID:848
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"2⤵PID:1620
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"2⤵PID:3008
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"2⤵PID:4512
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_5cdb901926cf524cc7a46e72c2a5760d_icedid_luca-stealer_njrat.exe"2⤵PID:4208
-