siriusrat | 60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe
Size 2.8MB
Sample260707-rhecmsgw8k
SHA256 60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56
MD5 ddeb98aef74364d5068836f404613d92
SHA1 6c672941ca5610ea2b50863fdfdac6180645986c
SHA512 f82e8a077fa66fa65f4cb450da2bb92884aac4087c7b1abf4cc7629620cc6fd99f30a0970db6dc2d411cbd11ddfbf89f10f4c87d3cc659e0f359fc59b2d013e0
SSDEEP 49152:3YNnGDNaciFItbKJZ6HlTbFav4l+ZzEUINav8aOuMBNn4VBj6Og6n/QwS2Ke:oJUNdiFItAZ6HlHFpUJvVOuy4V5a6/QG
TLSH
T11FD52398661AE913CB5423344AB2F2744278AFDEB901D22B5FD9BEFB7931F410C405A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

siriusrat persistence rat

Malware Config

Signatures

Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
rat siriusrat

Detects SiriusRAT 21 IoCs

resource	yara_rule
behavioral1/memory/4808-7-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/4808-8-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/4808-12-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/4808-15-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/4808-11-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/4808-10-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/4808-13-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/4808-21-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/4808-14-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3916-26-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3916-24-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3916-27-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3916-25-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3916-28-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3916-44-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3916-45-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/2916-55-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/2916-54-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/2916-53-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/2916-52-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/2916-51-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updater.vbs	WindowsMgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updater.vbs	WindowsMgr.exe

Executes dropped EXE 4 IoCs

pid	Process
2252	WindowsMgr.exe
3916	WindowsMgr.exe
1700	WindowsMgr.exe
2916	WindowsMgr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WindowsMgr.exe"	WindowsMgr.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1236 set thread context of 4808	1236	60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe	87
PID 2252 set thread context of 3916	2252	WindowsMgr.exe	93
PID 1700 set thread context of 2916	1700	WindowsMgr.exe	104

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Setup\Scripts\payload.exe	WindowsMgr.exe
File opened for modification	C:\Windows\Setup\Scripts\payload.exe	WindowsMgr.exe
File created	C:\Windows\Setup\Scripts\SetupComplete.cmd	WindowsMgr.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 4808	1236	60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe	87
PID 1236 wrote to memory of 4808	1236	60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe	87
PID 1236 wrote to memory of 4808	1236	60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe	87
PID 1236 wrote to memory of 4808	1236	60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe	87
PID 1236 wrote to memory of 4808	1236	60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe	87
PID 1236 wrote to memory of 4808	1236	60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe	87
PID 1236 wrote to memory of 4808	1236	60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe	87
PID 1236 wrote to memory of 4808	1236	60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe	87
PID 1236 wrote to memory of 4808	1236	60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe	87
PID 4808 wrote to memory of 2252	4808	60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe	88
PID 2252 wrote to memory of 3916	2252	WindowsMgr.exe	93
PID 2252 wrote to memory of 3916	2252	WindowsMgr.exe	93
PID 2252 wrote to memory of 3916	2252	WindowsMgr.exe	93
PID 2252 wrote to memory of 3916	2252	WindowsMgr.exe	93
PID 2252 wrote to memory of 3916	2252	WindowsMgr.exe	93
PID 2252 wrote to memory of 3916	2252	WindowsMgr.exe	93
PID 2252 wrote to memory of 3916	2252	WindowsMgr.exe	93
PID 2252 wrote to memory of 3916	2252	WindowsMgr.exe	93
PID 2252 wrote to memory of 3916	2252	WindowsMgr.exe	93
PID 1700 wrote to memory of 2916	1700	WindowsMgr.exe	104
PID 1700 wrote to memory of 2916	1700	WindowsMgr.exe	104
PID 1700 wrote to memory of 2916	1700	WindowsMgr.exe	104
PID 1700 wrote to memory of 2916	1700	WindowsMgr.exe	104
PID 1700 wrote to memory of 2916	1700	WindowsMgr.exe	104
PID 1700 wrote to memory of 2916	1700	WindowsMgr.exe	104
PID 1700 wrote to memory of 2916	1700	WindowsMgr.exe	104
PID 1700 wrote to memory of 2916	1700	WindowsMgr.exe	104
PID 1700 wrote to memory of 2916	1700	WindowsMgr.exe	104

C:\Users\Admin\AppData\Local\Temp\60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe
"C:\Users\Admin\AppData\Local\Temp\60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe
  C:\Users\Admin\AppData\Local\Temp\60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Users\Admin\AppData\Roaming\Microsoft\WindowsMgr.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\WindowsMgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Users\Admin\AppData\Roaming\Microsoft\WindowsMgr.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\WindowsMgr.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      PID:3916

C:\Users\Admin\AppData\Roaming\Microsoft\WindowsMgr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsMgr.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Roaming\Microsoft\WindowsMgr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\WindowsMgr.exe
  2⤵
  - Executes dropped EXE
  PID:2916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsMgr.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WindowsMgr.exe.log
Size 1KB
SHA256 f9e3291f3a63436719963ac8d141dd67550c1cc397eb3855e8fa538d6e76fed0
MD5 06063e2c19affd20aa596b8617db39fc
SHA1 d7356c57cd6faf12792a780781fea21bbdd92d9e
SHA512 400092a45c231d136c1246c59924376ff7141304c87951cbe8a45062c12aa0b9f53d1f9e00eb1f74333e02b4a403000772a3ed2dc7cf031087173f252e5acd65
TLSH
T12C31DD712276B1D889123F461C2D6AC017BF0726B690EE0C7998625EDE260175F212F7
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsMgr.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsMgr.exe
Size 2.8MB
SHA256 60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56
MD5 ddeb98aef74364d5068836f404613d92
SHA1 6c672941ca5610ea2b50863fdfdac6180645986c
SHA512 f82e8a077fa66fa65f4cb450da2bb92884aac4087c7b1abf4cc7629620cc6fd99f30a0970db6dc2d411cbd11ddfbf89f10f4c87d3cc659e0f359fc59b2d013e0
SSDEEP 49152:3YNnGDNaciFItbKJZ6HlTbFav4l+ZzEUINav8aOuMBNn4VBj6Og6n/QwS2Ke:oJUNdiFItAZ6HlHFpUJvVOuy4V5a6/QG
TLSH
T11FD52398661AE913CB5423344AB2F2744278AFDEB901D22B5FD9BEFB7931F410C405A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-6-0x0000022A71380000-0x0000022A71390000-memory.dmp

Download

memory/1236-3-0x0000022A589D0000-0x0000022A589F0000-memory.dmp

Download

memory/1236-4-0x0000022A71380000-0x0000022A71390000-memory.dmp

Download

memory/1236-5-0x0000022A72C40000-0x0000022A72EDC000-memory.dmp

Download

memory/1236-2-0x0000022A589A0000-0x0000022A589C2000-memory.dmp

Download

memory/1236-1-0x0000022A71380000-0x0000022A71390000-memory.dmp

Download

memory/1236-0-0x0000022A56970000-0x0000022A56C4E000-memory.dmp

Download

memory/2916-51-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/2916-52-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/2916-53-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/2916-54-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/2916-55-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3916-28-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3916-44-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3916-45-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3916-26-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3916-24-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3916-27-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3916-25-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4808-13-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4808-21-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4808-14-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4808-10-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4808-11-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4808-15-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4808-12-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4808-8-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4808-7-0x0000000140000000-0x0000000140558000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads