6f1cdc079812115df46d5cfc629e9ed8a9ed0d8d717de8d28bc9890b5578af4d

Analysis

max time kernel
102s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sheet rat v2.6/Stub/sigthief.exe
Size

6.4MB
MD5

3e261becbfe12d7a5ffdbba91c76011b
SHA1

2e5849aa0be921849f42121544895ce405fd9af1
SHA256

c85e5240da0e9d06677278f01c55f7d2611641ebeeafff9529e383e6948fd9ee
SHA512

02e897be04fd0d42300d6822f21cf8e435c53ef8ddd5054d9313fb348ad6ccfb70da3cec402d1aa1589217911f9bbfa3623d73dc647c23b0db3e0a656ffd76ae
SSDEEP

196608:R8H4yqXdQmRrdA6lXCy1ArqkVpKCX+PrF4ZHnFHeghaemVe:w4ySdQOlXrAZYCuPJOHnVeg

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
4816	sigthief.exe
4816	sigthief.exe
4816	sigthief.exe
4816	sigthief.exe
4816	sigthief.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5388 wrote to memory of 4816	5388	sigthief.exe	88
PID 5388 wrote to memory of 4816	5388	sigthief.exe	88

C:\Users\Admin\AppData\Local\Temp\sheet rat v2.6\Stub\sigthief.exe
"C:\Users\Admin\AppData\Local\Temp\sheet rat v2.6\Stub\sigthief.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5388
- C:\Users\Admin\AppData\Local\Temp\sheet rat v2.6\Stub\sigthief.exe
  "C:\Users\Admin\AppData\Local\Temp\sheet rat v2.6\Stub\sigthief.exe"
  2⤵
  - Loads dropped DLL
  PID:4816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI53882\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53882\_bz2.pyd

Filesize
81KB

MD5
23dce6cd4be213f8374bf52e67a15c91

SHA1
dfc1139d702475904326cb60699fec09de645009

SHA256
190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2

SHA512
c3983e2af9333a8538f68f7048b83c1bb32219c13adac26fd1036c3dc54394a3e2c1e4c0219232badd8e2c95418019b9b22906bdb23a19601447573a93c038a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53882\_lzma.pyd

Filesize
154KB

MD5
401eca12e2beb9c2fbf4a0d871c1c500

SHA1
7cfc2f94ade6712dd993186041e54917a3dd15ae

SHA256
5361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209

SHA512
da6b63ba4e2e7886701ff2462c11dd989d8a3f2a2a64bb4f5eed7271b017d69e6cfe7347e3d515fdf615ec81d2bb58367bcc1533b8a5073edf9474a3759f6d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53882\base_library.zip

Filesize
1.0MB

MD5
d5391ee8538a06d6622f31d3ec907407

SHA1
f322e086573ecf325f422fd0fdab032e2a8c22a0

SHA256
a11b40a99cc08c769c2bfb97c4996d3fe1052a204cbb9e3b4994c3fc4d32d341

SHA512
c0b46b54e4f358d9fceb65d471c755f77817a5ef5f6e87ff33c8d2eef1157d0ded4143d07aa72b92e1a40d6b7b025eb314695c80c85d67a383c14a7495b654a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53882\python310.dll

Filesize
4.3MB

MD5
54f8267c6c116d7240f8e8cd3b241cd9

SHA1
907b965b6ce502dad59cde70e486eb28c5517b42

SHA256
c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948

SHA512
f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53882\ucrtbase.dll

Filesize
993KB

MD5
9679f79d724bcdbd3338824ffe8b00c7

SHA1
5ded91cc6e3346f689d079594cf3a9bf1200bd61

SHA256
962c50afcb9fbfd0b833e0d2d7c2ba5cb35cd339ecf1c33ddfb349253ff95f36

SHA512
74ac8deb4a30f623af1e90e594d66fe28a1f86a11519c542c2bad44e556b2c5e03d41842f34f127f8f7f7cb217a6f357604cb2dc6aa5edc5cba8b83673d8b8bd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads