Analysis
- user interaction
yes - max time kernel
205s - max time network
194s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
31/08/2026, 12:19
Behavioral task
behavioral1
Sample
teeezt.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
12 signatures
300 seconds
Behavioral task
behavioral2
Sample
teeezt.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
300 seconds
General
- Target teeezt.exe
- Size 2.0MB
- Sample260831-phkhjs1fmd
- SHA256 89e2e31cd71c6b7d907a95d43c82335be305ce3f9aa753db26e3704b406d0c16
- MD5 d040dd4bcbba7a8d7bdf724115aaff26
- SHA1 bac2351bf9e42b4542b49b395f2ba71911e06971
- SHA512 2a2b74dc3f15e9dd3843232da2ea78c219a72a884ced69c0be0bcb0cb0db1241ac0def0404389a328516cfd7610de4ee823d2247c820be42fc87fe6f0a32744c
- SSDEEP 24576:W5uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:Gno8haujVsPAB8KY2+Bz+2
- TLSH T1D0A58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects SiriusRAT 1 IoCs
resource yara_rule behavioral1/files/0x000a000000023315-1.dat family_siriusrat - Executes dropped EXE 2 IoCs
pid Process 4676 svchost.exe 4916 svchost.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\ProgramData\\Microsoft\\svchost.exe" svchost.exe - Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5840 taskmgr.exe Token: SeSystemProfilePrivilege 5840 taskmgr.exe Token: SeCreateGlobalPrivilege 5840 taskmgr.exe Token: 33 5840 taskmgr.exe Token: SeIncBasePriorityPrivilege 5840 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe 5840 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4712 wrote to memory of 4676 4712 teeezt.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\teeezt.exe"C:\Users\Admin\AppData\Local\Temp\teeezt.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\ProgramData\Microsoft\svchost.exeC:\ProgramData\Microsoft\svchost.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4676
-
-
C:\ProgramData\Microsoft\svchost.exeC:\ProgramData\Microsoft\svchost.exe1⤵
- Executes dropped EXE
PID:4916
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5840
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4976
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\svchost.exe
- Size 2.0MB
- SHA256 89e2e31cd71c6b7d907a95d43c82335be305ce3f9aa753db26e3704b406d0c16
- MD5 d040dd4bcbba7a8d7bdf724115aaff26
- SHA1 bac2351bf9e42b4542b49b395f2ba71911e06971
- SHA512 2a2b74dc3f15e9dd3843232da2ea78c219a72a884ced69c0be0bcb0cb0db1241ac0def0404389a328516cfd7610de4ee823d2247c820be42fc87fe6f0a32744c
- SSDEEP 24576:W5uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:Gno8haujVsPAB8KY2+Bz+2
- TLSH T1D0A58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315
- MD5 SHA1 SHA512 SSDEEP TLSH