Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
05/10/2026, 16:13
General
- Target Sirius.exe
- Size 12.2MB
- Sample261005-tpg38axcmb
- SHA256 161fc9ed5fc3a34c4a0f1ac2af63cb6b447a59f58100fea701897ec154320353
Malware Config
Signatures
- Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
- Detects SiriusRAT 2 IoCs
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sirius.exe"C:\Users\Admin\AppData\Local\Temp\Sirius.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SiriusQT.exe"C:\Users\Admin\AppData\Local\Temp\SiriusQT.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Injector.exe"C:\Users\Admin\AppData\Local\Temp\Injector.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Injector.exe
SiriusQT.exe
memory/1932-22-0x00007FF610180000-0x00007FF6101BF000-memory.dmp
memory/4636-0-0x0000000074432000-0x0000000074433000-memory.dmp
memory/4636-1-0x0000000000E60000-0x0000000001AA4000-memory.dmp
memory/4636-2-0x0000000074420000-0x0000000074BDC000-memory.dmp
memory/4636-3-0x0000000006650000-0x0000000007282000-memory.dmp
memory/4636-23-0x0000000074432000-0x0000000074433000-memory.dmp
memory/4636-24-0x0000000074420000-0x0000000074BDC000-memory.dmp
memory/4636-26-0x0000000074420000-0x0000000074BDC000-memory.dmp