siriusrat | 2d4cb785d48a888c2542e90c51180c5279f306d15661f6ae72a14333e6f60de6

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e4ab4a5f19ed991c16cb7e8bce6f5415_glassworm_icedid_luca-stealer_njrat.exe
Size 2.0MB
Sample261027-esn9daat91
SHA256 2d4cb785d48a888c2542e90c51180c5279f306d15661f6ae72a14333e6f60de6
MD5 e4ab4a5f19ed991c16cb7e8bce6f5415
SHA1 c1f919b4e7ce811f7c8384476e38a082055986fc
SHA512 79ebdc7fe3333c8da13268054b980ca78e196706eb41d9e31ba6e3de79ebb54f1d7f4c0c049cdb61f18fa04c1688e2f7073bd88d6b825b69df8af809c2ba0a98
SSDEEP 24576:25uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:mno8haujVsPAB8KY2+Bz+2
TLSH
T13BA58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery siriusrat persistence privilege_escalation rat

Malware Config

Extracted

Family

siriusrat

tcp.niceports.shop:22057

Signatures

Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
rat siriusrat

Detects SiriusRAT 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016b43-1.dat	family_siriusrat

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016b43-1.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016b43-1.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016b43-1.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016b43-1.dat	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016b43-1.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016b43-1.dat	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016b43-1.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many Password Manager software clients. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016b43-1.dat	INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers

Detects executables referencing many email and collaboration clients. Observed in information steale 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016b43-1.dat	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Uses Session Manager for persistence 2 TTPs 2 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a00000043003a005c00570069006e0064006f00770073005c004d006900630072006f0073006f00660074005c0073007600630068006f00730074002e0065007800650000000000	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a00000043003a005c00570069006e0064006f00770073005c004d006900630072006f0073006f00660074005c0073007600630068006f00730074002e00650078006500000043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c00540065006d0070005c006d0073007500700064006100740065005c0073007600630068006f00730074002e0065007800650000000000	svchost.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk	svchost.exe

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\msupdate\svchost.exe	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
3980	svchost.exe
4732	svchost.exe
4740	svchost.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft\svchost.exe	2026-10-26_e4ab4a5f19ed991c16cb7e8bce6f5415_glassworm_icedid_luca-stealer_njrat.exe
File created	C:\Windows\Microsoft\svchost.exe	svchost.exe
File created	C:\Windows\Microsoft\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_e4ab4a5f19ed991c16cb7e8bce6f5415_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_e4ab4a5f19ed991c16cb7e8bce6f5415_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 3980	960	2026-10-26_e4ab4a5f19ed991c16cb7e8bce6f5415_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4732 wrote to memory of 4740	4732	svchost.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e4ab4a5f19ed991c16cb7e8bce6f5415_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e4ab4a5f19ed991c16cb7e8bce6f5415_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\Microsoft\svchost.exe
  C:\Windows\Microsoft\svchost.exe
  2⤵
  - Uses Session Manager for persistence
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:3980

C:\Windows\MICROS~1\svchost.exe
C:\Windows\MICROS~1\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\msupdate\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\msupdate\svchost.exe
  2⤵
  - Uses Session Manager for persistence
  - Creates a file in the Startup directory
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

line[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2T8DCGKW\line[1].txt
Size 3B
SHA256 a60f4b1bd140b73d5abfcc3e1a43137b9a18b97674123c162362873100d4bd9f
MD5 fad7aa65f9b2a35af671791f4d883839
SHA1 b40767244378b20e1c92f3837690dd384b19f520
SHA512 f093a0691d553046fb5b2da5bc208d4f38be0de833473591cb6ea1ffadb96f896371129257193baec4af5f631bb152abc9170b12ea85e1aa728e6a576bcadc80
MD5 SHA1 SHA512

Submit Download

WindowsUpdate.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk
Size 981B
SHA256 2a667c0758b449d4c4a84510cf3e1f6e0208a2fa57167591887c538c90d504c2
MD5 e35ed49fda1c905b63969eee6cb1319c
SHA1 71208a4517857f8d65e97ad4b6743c140587239d
SHA512 a36108b4e5caeb55b2967bca9367e840becb94ea7e4af02b43335a42378b0aea9898ef646115ffb719fb6ad18545dc14d03743c381d1bcd32ba6ef1a2d95b2c4
TLSH
T15011F10988E21F27C7BAC5BA40431B129A3A6D82F9E59F9D00064E801D2A750DE64E2F
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Windows\Microsoft\svchost.exe
Size 2.0MB
SHA256 2d4cb785d48a888c2542e90c51180c5279f306d15661f6ae72a14333e6f60de6
MD5 e4ab4a5f19ed991c16cb7e8bce6f5415
SHA1 c1f919b4e7ce811f7c8384476e38a082055986fc
SHA512 79ebdc7fe3333c8da13268054b980ca78e196706eb41d9e31ba6e3de79ebb54f1d7f4c0c049cdb61f18fa04c1688e2f7073bd88d6b825b69df8af809c2ba0a98
SSDEEP 24576:25uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:mno8haujVsPAB8KY2+Bz+2
TLSH
T13BA58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads