Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
04/05/2026, 11:36
General
- Target SiriusQT/#RunAsDate_x64.exe
- Size 73KB
- Sample260504-nqplssh12t
- SHA256 6d3c2b31fc940843e61e7c7be156f3987a99893491e63bdbd299da241770973b
Malware Config
Signatures
- Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
- Access Token Manipulation: Create Process with Token 1 TTPs 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"1⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"2⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"3⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"4⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"5⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"6⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"7⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"8⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"9⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"10⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"11⤵
- Checks computer location settings
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"12⤵
- Access Token Manipulation: Create Process with Token
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
#RunAsDate_x64.cfg
#RunAsDate_x64.cfg
memory/452-134-0x0000000000750000-0x00000000007FD000-memory.dmp
memory/452-124-0x0000000000750000-0x00000000007FD000-memory.dmp
memory/1708-52-0x0000000000720000-0x00000000007CD000-memory.dmp
memory/1708-62-0x0000000000720000-0x00000000007CD000-memory.dmp
memory/1828-86-0x0000000000830000-0x00000000008DD000-memory.dmp
memory/1828-76-0x0000000000830000-0x00000000008DD000-memory.dmp
memory/1984-98-0x00000000007E0000-0x000000000088D000-memory.dmp
memory/1984-88-0x00000000007E0000-0x000000000088D000-memory.dmp
memory/3084-64-0x0000000000830000-0x00000000008DD000-memory.dmp
memory/3084-74-0x0000000000830000-0x00000000008DD000-memory.dmp
memory/3100-28-0x00000000006D0000-0x000000000077D000-memory.dmp
memory/3100-38-0x00000000006D0000-0x000000000077D000-memory.dmp
memory/3244-50-0x0000000000770000-0x000000000081D000-memory.dmp
memory/3244-40-0x0000000000770000-0x000000000081D000-memory.dmp
memory/3660-26-0x00000000004D0000-0x000000000057D000-memory.dmp
memory/3660-16-0x00000000004D0000-0x000000000057D000-memory.dmp
memory/4180-100-0x0000000000850000-0x00000000008FD000-memory.dmp
memory/4180-110-0x0000000000850000-0x00000000008FD000-memory.dmp
memory/4264-0-0x00000000004D0000-0x000000000057D000-memory.dmp
memory/4264-14-0x00000000004D0000-0x000000000057D000-memory.dmp
memory/4516-112-0x00000000007F0000-0x000000000089D000-memory.dmp
memory/4516-122-0x00000000007F0000-0x000000000089D000-memory.dmp