darksiderat | 9de0aad86c35903be67941cc206cb675bab2621b831309a3e7f9fbaa650649f6

Analysis

user interaction
yes
max time kernel
10s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 15:12

Target
hotmoms.exe
Size 6.2MB
Sample260809-slhpxattcs
SHA256 9de0aad86c35903be67941cc206cb675bab2621b831309a3e7f9fbaa650649f6
MD5 1b9971afcae0445f029b89c4e6675ef1
SHA1 9527fe807e211a0a21055076d1d0e03edc2e3a20
SHA512 65eb7bbddac49438d0284a69f8278329613c5a8592b7f3f1ce68f0d38664e70c5101cc453ed2c0b3596e2a6c621cdf6380f68e5066b037656a89c9749574d3f6
SSDEEP 98304:mII/JztZV/OETNuSd+hSU4H5uWX/1JMg2xKYdRiqLIOE35rpT92t1ntk5aY+:mIuPV2ETNXEhSUCixn3iOaJtTUtg+
TLSH
T1E35622AE6640775CC01EC2309833FD49F3BA955D47E9D6EEB2CB27D067AE810E605B06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 4 IoCs

resource	yara_rule
behavioral1/memory/1216-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1216-3-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1216-4-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1216-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3772 set thread context of 1216	3772	hotmoms.exe	88

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 1216	3772	hotmoms.exe	88
PID 3772 wrote to memory of 1216	3772	hotmoms.exe	88
PID 3772 wrote to memory of 1216	3772	hotmoms.exe	88
PID 3772 wrote to memory of 1216	3772	hotmoms.exe	88
PID 3772 wrote to memory of 1216	3772	hotmoms.exe	88
PID 3772 wrote to memory of 1216	3772	hotmoms.exe	88
PID 3772 wrote to memory of 1216	3772	hotmoms.exe	88

C:\Users\Admin\AppData\Local\Temp\hotmoms.exe
"C:\Users\Admin\AppData\Local\Temp\hotmoms.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\hotmoms.exe
  "C:\Users\Admin\AppData\Local\Temp\hotmoms.exe"
  2⤵
  PID:1216

memory/1216-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1216-3-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1216-4-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1216-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3772-0-0x0000000140000000-0x0000000140A3A000-memory.dmp

Download

memory/3772-6-0x0000000140000000-0x0000000140A3A000-memory.dmp

Download