Analysis
- user interaction
yes - max time kernel
149s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
26/04/2026, 18:24
General
- Target Client.exe
- Size 564KB
- Sample260426-w16xtset7x
- SHA256 8d6ef2abc0645aa2cea78afdb225a4e5f4af6e9e02bd96ba3ef849c4f422ef26
Malware Config
Extracted
-
sheetrat
-
2.6
-
Sheet_tcwjcmmwqyakvk
-
klaw8puets.localto.net:3641
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat obfuscated V1.8 and higher 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Suspicious behavior: EnumeratesProcesses 25 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3404-0-0x0000000000AA0000-0x0000000000B34000-memory.dmp
memory/3404-1-0x00000000011F0000-0x0000000001221000-memory.dmp
memory/3404-2-0x00000000014C0000-0x00000000014CC000-memory.dmp
memory/3404-3-0x000000001BD20000-0x000000001BD30000-memory.dmp
memory/3404-4-0x00000000011F0000-0x0000000001221000-memory.dmp
memory/3404-6-0x00000000014D0000-0x00000000014D9000-memory.dmp
memory/3404-7-0x000000001BD20000-0x000000001BD30000-memory.dmp
memory/3404-39-0x000000001C130000-0x000000001C1A6000-memory.dmp
memory/3404-40-0x000000001C3F0000-0x000000001C536000-memory.dmp
memory/3404-41-0x000000001BCE0000-0x000000001BCFE000-memory.dmp