Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 03:42
General
- Target NEW PO & SAMPLE DETAILS.exe
- Size 2.7MB
- Sample260804-d9ln5scd97
- SHA256 13367ed6c45119783c7eccc3db9b7a9095a4d662d9f5e7bc1ae1d195958ab1e2
Malware Config
Signatures
- Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
- Detects SiriusRAT 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- SmartAssembly .NET packer 2 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW PO & SAMPLE DETAILS.exe"C:\Users\Admin\AppData\Local\Temp\NEW PO & SAMPLE DETAILS.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NEW PO & SAMPLE DETAILS.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\NEW PO & SAMPLE DETAILS.exe"C:\Users\Admin\AppData\Local\Temp\NEW PO & SAMPLE DETAILS.exe"2⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$55je5w=6726;$aa2hsp=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$55je5w=6726;$f3vr1a=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXFF5dlJxek9jTlYuZXhl')));$rcguw3=Get-Date;& $aa2hsp -FilePath $f3vr1a"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\QyvRqzOcNV.exe"C:\Users\Admin\AppData\Roaming\QyvRqzOcNV.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QyvRqzOcNV.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\QyvRqzOcNV.exeC:\Users\Admin\AppData\Roaming\QyvRqzOcNV.exe3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_bp4dqltl.gyz.ps1
QyvRqzOcNV.exe
memory/1952-24-0x0000022F2A7A0000-0x0000022F2B144000-memory.dmp
memory/1952-30-0x0000022F43920000-0x0000022F43930000-memory.dmp
memory/1952-23-0x0000022F2A7A0000-0x0000022F2B144000-memory.dmp
memory/1952-21-0x0000022F2A7A0000-0x0000022F2B144000-memory.dmp
memory/1952-28-0x0000022F43920000-0x0000022F43930000-memory.dmp
memory/1952-26-0x0000022F43920000-0x0000022F43930000-memory.dmp
memory/1952-39-0x0000022F2A7A0000-0x0000022F2B144000-memory.dmp
memory/1952-22-0x0000022F2A7A0000-0x0000022F2B144000-memory.dmp
memory/1952-11-0x0000022F2AF3C000-0x0000022F2AF3D000-memory.dmp
memory/1952-12-0x0000022F2A7A0000-0x0000022F2B144000-memory.dmp
memory/1952-13-0x0000022F2A7A0000-0x0000022F2B144000-memory.dmp
memory/1952-14-0x0000022F2A7A0000-0x0000022F2B144000-memory.dmp
memory/1952-15-0x0000022F2A7A0000-0x0000022F2B144000-memory.dmp
memory/1952-18-0x0000022F2B280000-0x0000022F2B2A2000-memory.dmp
memory/1952-19-0x0000022F2A7A0000-0x0000022F2B144000-memory.dmp
memory/1952-20-0x0000022F2A7A0000-0x0000022F2B144000-memory.dmp
memory/2012-27-0x0000000140000000-0x0000000140558000-memory.dmp
memory/2688-3-0x00007FFAB2010000-0x00007FFAB29B4000-memory.dmp
memory/2688-7-0x00007FFAB2010000-0x00007FFAB29B4000-memory.dmp
memory/2688-8-0x00007FFAB2010000-0x00007FFAB29B4000-memory.dmp
memory/2688-2-0x00007FFAB2010000-0x00007FFAB29B4000-memory.dmp
memory/2688-5-0x000002E62E600000-0x000002E62E614000-memory.dmp
memory/2688-29-0x00007FFAB2010000-0x00007FFAB29B4000-memory.dmp
memory/2688-25-0x000002E62E760000-0x000002E62E770000-memory.dmp
memory/2688-0-0x00007FFAB219F000-0x00007FFAB21A0000-memory.dmp
memory/2688-9-0x000002E630480000-0x000002E63071A000-memory.dmp
memory/2688-10-0x00007FFAB2010000-0x00007FFAB29B4000-memory.dmp
memory/2688-4-0x00007FFAB2010000-0x00007FFAB29B4000-memory.dmp
memory/2688-6-0x00007FFAB2010000-0x00007FFAB29B4000-memory.dmp
memory/2688-1-0x000002E613E40000-0x000002E614102000-memory.dmp
memory/3920-38-0x000001DE1B700000-0x000001DE1C0A4000-memory.dmp
memory/4548-48-0x0000024B6C1B0000-0x0000024B6C1CE000-memory.dmp
memory/4548-49-0x0000024B6C1D0000-0x0000024B6C282000-memory.dmp
memory/4548-50-0x0000024B6C170000-0x0000024B6C17A000-memory.dmp
memory/4548-52-0x0000024B53210000-0x0000024B53BB4000-memory.dmp
memory/5164-40-0x000001D5BB820000-0x000001D5BB834000-memory.dmp