siriusrat | 1e934d796c27c341542064a317fafaaea48d9c8184cb024dcbf84b18a2348d38

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/09/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chase Bank_Payment Advice.pdf.js
Size 61KB
Sample260917-sd2g2sfd47
SHA256 1e934d796c27c341542064a317fafaaea48d9c8184cb024dcbf84b18a2348d38
MD5 e7bd44b4dd5f0935a8f6f0590feb5f1b
SHA1 fb2afad8b8f0ef9c2a8feb9f8e9a4802bc1bb23c
SHA512 d543b4cf5d84543040a92052784379e36aecbd2b07b46ae128773f7331daf37b2a7c9a41ef79d405e1bbcb206cce4ff796a8739e3d056d0619a985339cedf649
SSDEEP 1536:3xmyMcO0H4DomUBIRjEjJ7ft7C7k7s7b77:CcO08omUBIRjEjlRMOWv7
TLSH
T16B534F07A3877BDCCA07728C8AC6932D95B46C154421B8D165EAD5EEEE6D83013FF227
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution siriusrat rat

Malware Config

Signatures

Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
rat siriusrat

Detects SiriusRAT 1 IoCs

resource	yara_rule
behavioral2/memory/3880-38-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	956	cmd.exe	87

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	3940	powershell.exe
2	3940	powershell.exe
4	3940	powershell.exe
5	3940	powershell.exe
6	3940	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4816	powershell.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/3940-29-0x00000218D8B30000-0x00000218D8B62000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3940 set thread context of 3880	3940	powershell.exe	100

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1484	cmd.exe
1616	cmd.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5596	taskkill.exe
4892	taskkill.exe
256	taskkill.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3940	powershell.exe
3940	powershell.exe
4816	powershell.exe
4816	powershell.exe
3940	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	5596	taskkill.exe
Token: SeDebugPrivilege	4892	taskkill.exe
Token: SeDebugPrivilege	256	taskkill.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 3940	1484	cmd.exe	90
PID 3940 wrote to memory of 6140	3940	powershell.exe	91
PID 6140 wrote to memory of 2892	6140	csc.exe	92
PID 3940 wrote to memory of 4816	3940	powershell.exe	93
PID 4816 wrote to memory of 1616	4816	powershell.exe	95
PID 1616 wrote to memory of 5596	1616	cmd.exe	97
PID 1616 wrote to memory of 4892	1616	cmd.exe	98
PID 1616 wrote to memory of 256	1616	cmd.exe	99
PID 3940 wrote to memory of 3880	3940	powershell.exe	100
PID 3940 wrote to memory of 3880	3940	powershell.exe	100
PID 3940 wrote to memory of 3880	3940	powershell.exe	100
PID 3940 wrote to memory of 3880	3940	powershell.exe	100
PID 3940 wrote to memory of 3880	3940	powershell.exe	100
PID 3940 wrote to memory of 3880	3940	powershell.exe	100
PID 3940 wrote to memory of 3880	3940	powershell.exe	100
PID 3940 wrote to memory of 3880	3940	powershell.exe	100
PID 3940 wrote to memory of 3880	3940	powershell.exe	100
PID 3940 wrote to memory of 3880	3940	powershell.exe	100

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Chase Bank_Payment Advice.pdf.js"
1⤵
PID:3152

C:\Windows\system32\cmd.exe
cmd /c %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe .($env:ComSpec[4,26,25]-join'') $env:dkkomoigz;
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .($env:ComSpec[4,26,25]-join'') $env:dkkomoigz;
  2⤵
  - Badlisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oyseyaha\oyseyaha.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6140
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3D7C.tmp" "c:\Users\Admin\AppData\Local\Temp\oyseyaha\CSC2724F2BF60C94EC3ADFF6E74DC12C51D.TMP"
      4⤵
      PID:2892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1616
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5596
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4892
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:256
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 09615b811d6e40c862deb98195386a32bb894576408788af3eeb114744219f90
MD5 6128f1bb06e9e77dcb271a8dd125cd0d
SHA1 f46eb137d8e72c289ce04384635ea541efd5bd0b
SHA512 55dd1a445f02320c6f2d2c382b7c4e66dc50cfe6c09f657e2c8df61926c25e04e5cd854c8728d67891fe56bf6251309f60ba1a8ee4015f0d112a7cb530d618ce
TLSH
T112317433B3DC8615D889413A50CEAC0432B1C7EB419ECE6BBB84D658B03F5A9CEA0260
MD5 SHA1 SHA512 TLSH

Submit Download

RES3D7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3D7C.tmp
Size 1KB
SHA256 5ebc28d8ad9f3e7ef3994c6d8876a4509d8bea5a0c33d3c9eb827a7d77183e2e
MD5 bda175e1aac2439cd273df6fb04136f1
SHA1 84925fe43b57cabf258c2e3b867c1ee29c479e6f
SHA512 87753d7dedaf968b2c4c3e3ec538eb118c32caa9f82a6391e8f8deedf54a2c382bfbb56699ca4e90edcbd0a678305643ade8605c0f303a669d2dce28425876bc
TLSH
T1DF21CC4153E8435FF0775B3169FA072BA275FC64DF72935A458042282C50204EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

oyseyaha.dll

Path C:\Users\Admin\AppData\Local\Temp\oyseyaha\oyseyaha.dll
Size 3KB
SHA256 fedd063ea26a493c3dbfcda2ebda3d98da85166594ede363a77482cdca57377e
MD5 a615d522f389e2870c9da4a6582dc782
SHA1 f0cc21db070e49bdfbcf0808ad772fa675f8b5fe
SHA512 fb16c80034bbf18bcef00862b5af778bc7ba4330a3b138754496c3dfc8891d06b6d5db5f634ea9a2792bdbcc9989b7731f25a58a6187553dac098aa111d6e055
TLSH
T1F951CD1A63E8466BE4770B317EF743572774F9209B72535E498002A8BC213646E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2724F2BF60C94EC3ADFF6E74DC12C51D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\oyseyaha\CSC2724F2BF60C94EC3ADFF6E74DC12C51D.TMP
Size 652B
SHA256 7b63cf2154995657db16030619ce05ab5f9e5572a4d000ed77fe7159b07bedfc
MD5 6b510c531725e0b401bd55dc94e1c23d
SHA1 61c23f7da9cd39777496df183a6c97a6be9673df
SHA512 7f21466398608c2631b7654f23f6a88c86144b675216f8173b7c7fa124f50d789f8da16153c12d5874681e1fc3b5fc018ddecc4ce7a414bc82ab08eafffc80b0
TLSH
T122F05E4963F8520EF0F75F30BDF6836391A9BC64DE3293ED1540136928646109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

oyseyaha.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\oyseyaha\oyseyaha.0.cs
Size 213B
SHA256 a0fdb9548ff75cbf48acee5affaa578eb60798807cb792da4d9640cfb371f157
MD5 5406714dfd58ae688d2c3b98082fab53
SHA1 7661a7744b9c40379bb479ff527fc8923696cf11
SHA512 7f0c60c8508a7fe17edd1f08b9207464d8471f07d563acd20a7d971fc249731a4851b7d1a2000ffce1da712a55a8d161511b409bf985b4bf9a60bc83d5a3ccc7
TLSH
T1FDD0A9803686F3384B9305073C03B89A223FA71103EA6408D86A0C83EE08070BB38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

oyseyaha.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\oyseyaha\oyseyaha.cmdline
Size 369B
SHA256 56c162fd79aa76fc6c1d6d856144e66138921bbda48740e8e27c780ae35905c0
MD5 694ecc711099d517478c94a96f70db1e
SHA1 4fe7651b4142e1d581a29bb2311ca9321bc4bc1d
SHA512 a2bf497e3927739ccb2f2d1e1894218fd81da0abf8459007e9525f8b28dec495e7fabdd2c98ef9e0e5f499b1f358c1bb413c0de57faa9cae495535280ae551b7
TLSH
T1B6E0C62E4246C27D09ED200B266AE4BCF3730F8329903F84A08088EDF1770003BD2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3880-38-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3940-9-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-28-0x00000218D8C10000-0x00000218D8C18000-memory.dmp

Download

memory/3940-11-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-12-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-13-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-14-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-15-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-0-0x00007FFE8D00F000-0x00007FFE8D010000-memory.dmp

Download

memory/3940-8-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-7-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-5-0x00000218F1200000-0x00000218F1222000-memory.dmp

Download

memory/3940-10-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-6-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-29-0x00000218D8B30000-0x00000218D8B62000-memory.dmp

Download

memory/3940-33-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-35-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-36-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-37-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-2-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-40-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-1-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download

memory/3940-43-0x00007FFE8CE80000-0x00007FFE8D824000-memory.dmp

Download