darksiderat | 9de0aad86c35903be67941cc206cb675bab2621b831309a3e7f9fbaa650649f6

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:12

Target
hotmoms.exe
Size 6.2MB
Sample260809-slhpxattcs
SHA256 9de0aad86c35903be67941cc206cb675bab2621b831309a3e7f9fbaa650649f6
MD5 1b9971afcae0445f029b89c4e6675ef1
SHA1 9527fe807e211a0a21055076d1d0e03edc2e3a20
SHA512 65eb7bbddac49438d0284a69f8278329613c5a8592b7f3f1ce68f0d38664e70c5101cc453ed2c0b3596e2a6c621cdf6380f68e5066b037656a89c9749574d3f6
SSDEEP 98304:mII/JztZV/OETNuSd+hSU4H5uWX/1JMg2xKYdRiqLIOE35rpT92t1ntk5aY+:mIuPV2ETNXEhSUCixn3iOaJtTUtg+
TLSH
T1E35622AE6640775CC01EC2309833FD49F3BA955D47E9D6EEB2CB27D067AE810E605B06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4756-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4756-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4980 set thread context of 4756	4980	hotmoms.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4756	4980	hotmoms.exe	90
PID 4980 wrote to memory of 4756	4980	hotmoms.exe	90
PID 4980 wrote to memory of 4756	4980	hotmoms.exe	90
PID 4980 wrote to memory of 4756	4980	hotmoms.exe	90
PID 4980 wrote to memory of 4756	4980	hotmoms.exe	90
PID 4980 wrote to memory of 4756	4980	hotmoms.exe	90
PID 4980 wrote to memory of 4756	4980	hotmoms.exe	90

C:\Users\Admin\AppData\Local\Temp\hotmoms.exe
"C:\Users\Admin\AppData\Local\Temp\hotmoms.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\hotmoms.exe
  "C:\Users\Admin\AppData\Local\Temp\hotmoms.exe"
  2⤵
  PID:4756

memory/4756-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4756-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4980-0-0x0000000140000000-0x0000000140A3A000-memory.dmp

Download

memory/4980-3-0x0000000140000000-0x0000000140A3A000-memory.dmp

Download