Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 15:25
General
- Target 6889770684_NursultanCrack.exe
- Size 246KB
- Sample260421-stk51act2t
- SHA256 02bb781d92aa8a8644820c8ee31bc9bc885f4d53266e1912e784e2af11d69637
Malware Config
Extracted
-
sheetrat
-
anti_virtual
false
-
certificate
q9c4ibl3wvtm5
-
exclusion_wd
false
-
hidden_file
true
-
key
7dq1sg3
-
path_client
%ProgramFiles%\xdwdSearch.exe
-
path_watch_dog
%Windows%\Searcher.exe
-
pump
true
-
rootkit
0vz2oiloklix5md7x64
-
task_client
ShellHost
-
task_watch_dog
CookieManager
-
use_install_admin
true
-
user_init
true
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 6 IoCs
- Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Program Files directory 6 IoCs
- Drops file in Windows directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6889770684_NursultanCrack.exe"C:\Users\Admin\AppData\Local\Temp\6889770684_NursultanCrack.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="p} \0ye50 2>0]" dir=in action=allow program="C:\Program Files\xdwdSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\xdwdSearch.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\xdwdSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\Searcher.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\Searcher.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\xdwdSearch.exe"C:\Program Files\xdwdSearch.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Searcher.exeC:\Windows\Searcher.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\xdwdSearch.exe"C:\Program Files\xdwdSearch.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\xdwdSearch.exe"C:\Program Files\xdwdSearch.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
xdwdSearch.exe.log
xdwd.dll
memory/764-130-0x000001EDB8320000-0x000001EDB8332000-memory.dmp
memory/764-129-0x000001EDB8310000-0x000001EDB831C000-memory.dmp
memory/1452-119-0x000002C7433B0000-0x000002C7433C2000-memory.dmp
memory/1452-118-0x000002C7433A0000-0x000002C7433AC000-memory.dmp
memory/1720-117-0x000001A101990000-0x000001A1019A2000-memory.dmp
memory/1720-116-0x000001A101980000-0x000001A10198C000-memory.dmp
memory/2008-0-0x000002056E3F0000-0x000002056E434000-memory.dmp
memory/2008-113-0x000002056E880000-0x000002056E88C000-memory.dmp
memory/2008-4-0x0000020570C70000-0x0000020570C80000-memory.dmp
memory/2008-3-0x000002056E890000-0x000002056E8A2000-memory.dmp
memory/2008-2-0x000002056E880000-0x000002056E88C000-memory.dmp
memory/2008-1-0x0000020570C70000-0x0000020570C80000-memory.dmp
memory/3396-146-0x000001E74FD20000-0x000001E74FD2C000-memory.dmp
memory/3396-147-0x000001E74FD30000-0x000001E74FD42000-memory.dmp