Analysis
-
max time kernel
104s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
28/03/2025, 17:33
General
-
Target
sheet rat v2.6/Server.exe
-
Size
1.3MB
-
MD5
dd6667db55acaefa2d7e99dcf5d97a26
-
SHA1
c1b281ef573df4da584294c61b5322edfed589ad
-
SHA256
ce8fd5ec0b2ee4e5d87d35622eeaa022ee971801c97bcb3726ca6ebe4b576238
-
SHA512
916c8b63400c0a8e495fc59d8e348499a6f04421e79599803c7ac4cd828c82f389bfd733471de27cc1643c03723429f8544446d9adc69082e6a5032139a1f1f1
-
SSDEEP
24576:RIVMEFyWLoQJV+fLmomlEkmmsEnE7E7E7EUmemmmmmmIDmeIjwnaKk:RWMEMWlVILmomSkmmtEQQQUmemmmmmm7
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sheet rat v2.6\Server.exe"C:\Users\Admin\AppData\Local\Temp\sheet rat v2.6\Server.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD514393eb908e072fa3164597414bb0a75
SHA15e04e084ec44a0b29196d0c21213201240f11ba0
SHA25659b9d95ae42e35525fc63f93168fe304409463ee070a3cf21a427a2833564b80
SHA512f5fc3d9e98cca1fbbbe026707086a71f801016348d2355541d630879ad51a850f49eb4a5f7a94e12a844d7a7108d69fa6d762ee19f4805d6aafef16259b4330b
-
Filesize
687B
MD5b18785caae8834f89e34cde89b93cafc
SHA1cee194149b484295ddba88111a251986bdc0c7af
SHA256105971bbe15f24f50dad97d466b55222e52dfdb4a71b1b3a6452cfba28a10811
SHA512fb108e2997a0ea7bce21113118997f358d73a43a40e2b4b9962738cd88dc6d9dfc17e17e63c8ba8c5a5504e5775fbe9e8084ee8e6086cf0eab709335ed8b282c
-
Filesize
311B
MD5a35bc67d130a4fb76c2c2831cbdddd55
SHA166502423bba03870522e50608212b6ee27ebf4c5
SHA256e94a97e512fbc8ed9f5691d921fdeddbff4cc16b024c5335adf66bff3a7a8192
SHA5124401b234d7914afa860e356be1667cc5f44402255f7cc6cc3d8df80883167f6b55463e62156df57be697ee501897fac61a71f97911c6fdb6630272341ac8a07e
-
Filesize
434B
MD5cfcf8e91857f364e002065c52ff8f91c
SHA18407ecb3c33a1f3fcf18a723e6884acf7e5a0f4a
SHA256572dda8c7f211dc6a4efc7aecb4a54cb4e0ced1e4c9a4b9f96bb329c983c64e6
SHA512364fecac3a051441b4fefcebb2cc9e38632f99dd04593cd5d9b148986afb09b195e88cdbfa2e778b8934564b76d04fe053f919f0a60769b023f2f753ede06d1e
-
Filesize
561B
MD52e8ab7cdc2081c09a98f6c5593909409
SHA1282769c943f8ab0429315869466d042a99de95f4
SHA25617eee8708a1bbc35422e6ad9b6eff3bec4f8a8b8a87cce8e6cc0da2d94c9b3ae
SHA512b815e0deaea5348d5ec68cdba3e4b5018e6224299f170859181f90961831b7d14deda144b32d64b11f8da7f4cbdb0b86a8d253b0ee179df68baac274a363ef2a
-
Filesize
4KB
-
Filesize
2.3MB
-
Filesize
7.7MB
-
Filesize
680KB
-
Filesize
7.7MB
-
Filesize
176KB
-
Filesize
2.9MB
-
Filesize
3.3MB
-
Filesize
136KB
-
Filesize
1.3MB
-
Filesize
5.6MB
-
Filesize
304KB
-
Filesize
132KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
368KB
-
Filesize
1.3MB
-
Filesize
240KB
-
Filesize
7.7MB
-
Filesize
712KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB