Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22-07-2024 14:28
Behavioral task
behavioral1
Sample
SheetRat/Server-cleaned.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
SheetRat/Server-cleaned.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
SheetRat/Server-cleaned.exe
-
Size
1.3MB
-
MD5
c1862c57cf6b6c302f71ef986950328f
-
SHA1
2b5df84beb75f758e2b50f9d8c1d73cc59bf9936
-
SHA256
f90bcd094d81b324edfa8413b4ae9a6a51a38058520b2572151a91205e9b788f
-
SHA512
de5cd2be9933e317d48b2b8556a260a5427ca88e8653975951d9d6364cebea91e3cc500a724a7d38c314d449c84ba9cb12988f3d2425905e149f1a095f90ef2d
-
SSDEEP
24576:YLysNT+f7momlEkmmsEnE7E7E7EUmemmmmmmIzme4jwnaKEmbToQ2:Y2sNTI7momSkmmtEQQQUmemmmmmmIzm/
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 2304 Server-cleaned.exe 2304 Server-cleaned.exe 2304 Server-cleaned.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2056 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2304 Server-cleaned.exe Token: SeDebugPrivilege 2056 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SheetRat\Server-cleaned.exe"C:\Users\Admin\AppData\Local\Temp\SheetRat\Server-cleaned.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2056
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Server\Server-cleaned.exe_Url_v01rgh5g1psgca1y4pynyjgu3xx5dv4c\1.0.0.0\iuuxttzx.newcfg
Filesize1KB
MD57cf968e0ae06a462ba72a5d7d1fdc88a
SHA195dc2fe0f93f3952e808ca85a2e76b35e06b3878
SHA25687ca18aad1637b36c6e5aaa982110681d1c81e897667b9a38003f3c1052d289f
SHA51249e362871abd1ea9f0ffaaa764b479ed7efaf5e179d87e8f070d0cdebc7bce26f558b1bbe649d837f39d343cb0c4fc6a67cb313f19e4e06c03f4f7f43ad12fd9
-
C:\Users\Admin\AppData\Local\Server\Server-cleaned.exe_Url_v01rgh5g1psgca1y4pynyjgu3xx5dv4c\1.0.0.0\user.config
Filesize797B
MD51dc25fcc9d2526c8def3bf40c1bfaf69
SHA18ea5d1e6b4f6aba87727fa313d40740071d46bce
SHA25662f5c0be8ea24233cf5660b2d1a0d1f0e7319415f5caf14e7ae84e3c9e2632c4
SHA512845b5f4eeb05d5bb57fd94fdac623d2a3b3ef9365ad4c712667f09912c21ed4d4ef242021124cef40a29fd4ecfb851e8668be854b78dae284a32ecb7e255c970
-
C:\Users\Admin\AppData\Local\Server\Server-cleaned.exe_Url_v01rgh5g1psgca1y4pynyjgu3xx5dv4c\1.0.0.0\user.config
Filesize920B
MD5db822f44e045c6bce441574f8e8614e6
SHA1e74eb4fc67ddacbf01d66c82a776a04bffc13004
SHA2564984544e2fa632fc296eac6050f8ba3e2f60e585d6be6ef08b49d2bce47a51a5
SHA51280790a1c19b764d07243db826cbf38b224e40cf6be66984141f8d436c5f8be6af2a4be2db81eb2834cc9beb15313474c0f64d694603e1fc6287767b997adc922
-
C:\Users\Admin\AppData\Local\Server\Server-cleaned.exe_Url_v01rgh5g1psgca1y4pynyjgu3xx5dv4c\1.0.0.0\user.config
Filesize1KB
MD53e83308de9805817d7c747a0773199ab
SHA113bd5f4085f08bdadb67ad22bba2b4d62895d533
SHA256dae07fa593aaa1d8638c277d2e4c936986480528e5fb24bdfbf31971df19b81e
SHA51273643a5f42f2208bc2663b20b5b49aa74c328736c0ac395774d7aa72bad6d760e997c17f5c7d479e611c5ec0c23cb7b74415f9c95fca0973ef3c84c176bdb0f4
-
Filesize
1.3MB
MD514393eb908e072fa3164597414bb0a75
SHA15e04e084ec44a0b29196d0c21213201240f11ba0
SHA25659b9d95ae42e35525fc63f93168fe304409463ee070a3cf21a427a2833564b80
SHA512f5fc3d9e98cca1fbbbe026707086a71f801016348d2355541d630879ad51a850f49eb4a5f7a94e12a844d7a7108d69fa6d762ee19f4805d6aafef16259b4330b