6d3c2b31fc940843e61e7c7be156f3987a99893491e63bdbd299da241770973b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 11:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SiriusQT/#RunAsDate_x64.exe
Size 73KB
Sample260504-nqplssh12t
SHA256 6d3c2b31fc940843e61e7c7be156f3987a99893491e63bdbd299da241770973b
MD5 a591b0ca3fe24ff46759b8752108fb5a
SHA1 1665ed72049950f980794b36e956db7e65e1fb79
SHA512 a1b63a72ee98f3f0ad00128af3e81d49f72669b8909241ed1ed195ad302ad380c4cbf89a99bf9ab5b78779fa19dd4cda8945cb66ca61d26ff7de868ac8925bea
SSDEEP 1536:A3MAFzmXHXx/cIjTPj7YGG0GJYcBUBSlVbit:A3MAF2dVEbYuUB0y
TLSH
T1BB738E86A3B801D9D866CB70CAB68713DFB07D115972C31F27B4E1999FA33306E24726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion privilege_escalation

Malware Config

Signatures

Access Token Manipulation: Create Process with Token 1 TTPs 8 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
5544	#RunAsDate_x64.exe
5028	#RunAsDate_x64.exe
72	#RunAsDate_x64.exe
3240	#RunAsDate_x64.exe
3880	#RunAsDate_x64.exe
5212	#RunAsDate_x64.exe
2196	#RunAsDate_x64.exe
4120	#RunAsDate_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5544 wrote to memory of 5028	5544	#RunAsDate_x64.exe	78
PID 5028 wrote to memory of 72	5028	#RunAsDate_x64.exe	79
PID 72 wrote to memory of 3240	72	#RunAsDate_x64.exe	80
PID 3240 wrote to memory of 3880	3240	#RunAsDate_x64.exe	81
PID 3880 wrote to memory of 5212	3880	#RunAsDate_x64.exe	82
PID 5212 wrote to memory of 2196	5212	#RunAsDate_x64.exe	83
PID 2196 wrote to memory of 4120	2196	#RunAsDate_x64.exe	84

C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe
"C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"
1⤵
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"
  2⤵
  - Access Token Manipulation: Create Process with Token
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"
    3⤵
    - Access Token Manipulation: Create Process with Token
    - Suspicious use of WriteProcessMemory
    PID:72
  - - C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"
      4⤵
      Access Token Manipulation: Create Process with Token
      Suspicious use of WriteProcessMemory
      PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"
        5⤵
        Access Token Manipulation: Create Process with Token
        Suspicious use of WriteProcessMemory
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"
        6⤵
        Access Token Manipulation: Create Process with Token
        Suspicious use of WriteProcessMemory
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"
        7⤵
        Access Token Manipulation: Create Process with Token
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.exe"
        8⤵
        Access Token Manipulation: Create Process with Token
        
        PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

#RunAsDate_x64.cfg

Path C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.cfg
Size 349B
SHA256 e4f9859252b9cb339eade0b728cc6e45849ad0fa4d4d13c17af08121ccccecc7
MD5 cbd76e9abad2ab40265d6f217d68b6c3
SHA1 4e8afb44f53b39e905b1c890c556e98a746b9da2
SHA512 5fb2db2a368c782452ca47d7a5aa795961a47bc4f4f6a71eab1f7291c3c9035e5d0dfc50e22de9ac5396c888ecc7499c93bd47647c4d3f5f6cc40ce61ed72415
TLSH
T1F9E0C24584AB497EC4735F1E50A2314418B58E1379C55CF0F3DF7B89CD9A84266ED801
MD5 SHA1 SHA512 TLSH

Submit Download

#RunAsDate_x64.cfg

Path C:\Users\Admin\AppData\Local\Temp\SiriusQT\#RunAsDate_x64.cfg
Size 349B
SHA256 9c15a968d3c93c0153ec3a50a061066af3f6069ffd860512956396a0fc24c81c
MD5 7dd79092e72bbe1607bcb81acf341ace
SHA1 4e2f4abb4dd9c6acd88f015e15b5c8a6f0a6931e
SHA512 d858d3095cda055553a787987b5e1b04061ac72c77dd312b21006ef89ca2a734963b19d584bb6e10d1417291f9669c65fa9afffcf0181ad5350f0d027da6b7ab
TLSH
T1F9E0C24488AB497EC4735F1E50B2314418B98E1379C55CF0F3DF6B89CD9A84266ED801
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads