f2c0c5bbd1d08aacef612bbbf6bfcf81367389b07bc0464a750b28f4c86e7154

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 11:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SiriusQT/SiriusQT_Cracked_Launcher.bat
Size 117B
Sample260504-nqplssh12t
SHA256 f2c0c5bbd1d08aacef612bbbf6bfcf81367389b07bc0464a750b28f4c86e7154
MD5 0a8c06539748c16007cda7707ec009c1
SHA1 dfa7a34b2c6becdf6d345a5fa4bd9723f69f0ea4
SHA512 96a2f25b510fef229723cb800acdf908e32b945cd966e151803226cdc687f28b725d8867c8db16fd81c54c97f41c51fac954961c5674c71e0e21c1b66a24beaa
TLSH
T146B0929A5022981C9822B58409A2AAB7B08BC07B30C167807683B135A987815A94E7BA
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion privilege_escalation

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5076	SiriusQT.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
4492	#RunAsDate_x64.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SiriusQT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SiriusQT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	SiriusQT.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4348	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5076	SiriusQT.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5076	SiriusQT.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5076	SiriusQT.exe
5076	SiriusQT.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5636 wrote to memory of 4348	5636	cmd.exe	80
PID 5636 wrote to memory of 4492	5636	cmd.exe	82
PID 4492 wrote to memory of 5076	4492	#RunAsDate_x64.exe	83
PID 4492 wrote to memory of 5076	4492	#RunAsDate_x64.exe	83
PID 4492 wrote to memory of 5076	4492	#RunAsDate_x64.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SiriusQT\SiriusQT_Cracked_Launcher.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM SiriusQT.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4348
- C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe
  "#RunAsDate_x64.exe" /movetime 02\01\2024 00:00:00 "C:\Users\Admin\AppData\Local\Temp\SiriusQT\SiriusQT.exe"
  2⤵
  - Access Token Manipulation: Create Process with Token
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Users\Admin\AppData\Local\Temp\SiriusQT\SiriusQT.exe
    "C:\Users\Admin\AppData\Local\Temp\SiriusQT\SiriusQT.exe"
    3⤵
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dateinj01.dll

Path C:\Users\Admin\AppData\Local\Temp\dateinj01.dll
Size 4KB
SHA256 66dd4c1aed3d7590a844d3373601f3549ef8bdc05fa33b5671c18b85cc7dacad
MD5 8acecb7d5a4e62df54b828926d72b99d
SHA1 125d6351a22b6422c46f1aa9406369858531d94b
SHA512 06379820cac075e46e13e9fa142f59b05b4e42af74434e94ade893e622144e85cfae1165d99b74ddd76d18fe7cb30f7b90aedc1a50a9b7206f27ff4d3b348819
SSDEEP 48:qP5x03VWvnzfnc0rmgwlQDK/QKjiwXdgqppK/VmGvkDwrl:+5qFWvnrnFtwaOQzwXazVBz
TLSH
T1619198AFF31286E9C84E47B8DEF96D027274356942B5472F049340E9CE635492F26A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4348-0-0x000001EAB3350000-0x000001EAB3426000-memory.dmp

Download

memory/5076-2-0x000001B973FB0000-0x000001B973FB1000-memory.dmp

Download

memory/5076-4-0x00007FFAEBED0000-0x00007FFAEC425000-memory.dmp

Download

memory/5076-3-0x00007FF6DAFB0000-0x00007FF6DBB8D000-memory.dmp

Download

memory/5076-9-0x000001B973FB0000-0x000001B973FB1000-memory.dmp

Download

memory/5076-8-0x000001B975BB0000-0x000001B975C86000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads