sheetrat | e831de437b3cf279bedf39ac3d1af2295503aa4a93f45d28c5c573b5210a602c

Resubmissions

18/07/2026, 00:54

260718-a9qfjsey9s10

03/05/2026, 11:33

260503-nn17tabv3n10

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
start.exe
Size 301KB
Sample260503-nn17tabv3n
SHA256 e831de437b3cf279bedf39ac3d1af2295503aa4a93f45d28c5c573b5210a602c
MD5 60a2ac8ed9f057a748625d8be9458444
SHA1 4515ecd7f90554e572233bf8d86bef21116b32ad
SHA512 82fe85ae6f686adf6da9ce8816a28c621c9e5f54b4381a95785c315892d626af103320e1aa14808500a052e4704f64dbfc3c28f4f3d556f3b8a1117c313e1e3e
SSDEEP 6144:rKq869LKHmH3flFcYxuNHIA/b5dO73jvCGz1boSNq:+qBOGv46wHIA/VGzvX1E
TLSH
T1AC642343A2DB8230C25D85BB94D2C4412BB79E4976B6D38C7D447F92CB6362E6CB3235
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution sheetrat unix_stealer persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

sheetrat

Version

vote-ist.gl.at.ply.gg:2643

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat
Family: UnixStealer
UnixStealer is a Windows stealer written in C#.
stealer unix_stealer

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/files/0x00080000000242d9-6.dat	family_sheetrat_v4
behavioral1/memory/4012-22-0x0000000000D90000-0x0000000000DF2000-memory.dmp	family_sheetrat_v4

Detects UnixStealer payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000242dc-17.dat	family_unixstealer
behavioral1/memory/3680-26-0x0000024724740000-0x0000024724790000-memory.dmp	family_unixstealer

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\svchost.exe"	svchost.exe

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
816	wevtutil.exe
5084	wevtutil.exe
1716	wevtutil.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	start.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 7 IoCs

pid	Process
4012	svchost.exe
3680	Build.exe
4536	svchost.exe
1608	svchost.exe
2708	svchost.exe
2376	svchost.exe
824	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Build.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3876	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1428	schtasks.exe
4864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3680	Build.exe
3680	Build.exe
3680	Build.exe
3680	Build.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3680	Build.exe
Token: SeDebugPrivilege	4012	svchost.exe
Token: SeDebugPrivilege	4536	svchost.exe
Token: SeDebugPrivilege	1608	svchost.exe
Token: SeIncBasePriorityPrivilege	4536	svchost.exe
Token: SeDebugPrivilege	2708	svchost.exe
Token: SeSecurityPrivilege	5084	wevtutil.exe
Token: SeBackupPrivilege	5084	wevtutil.exe
Token: SeSecurityPrivilege	816	wevtutil.exe
Token: SeBackupPrivilege	816	wevtutil.exe
Token: SeSecurityPrivilege	1716	wevtutil.exe
Token: SeBackupPrivilege	1716	wevtutil.exe
Token: SeDebugPrivilege	2376	svchost.exe
Token: SeDebugPrivilege	824	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4012	4168	start.exe	84
PID 4168 wrote to memory of 3680	4168	start.exe	85
PID 4012 wrote to memory of 5004	4012	svchost.exe	90
PID 4012 wrote to memory of 2784	4012	svchost.exe	92
PID 2784 wrote to memory of 1428	2784	cmd.exe	94
PID 4012 wrote to memory of 3360	4012	svchost.exe	95
PID 3360 wrote to memory of 4864	3360	cmd.exe	97
PID 4012 wrote to memory of 1608	4012	svchost.exe	101
PID 3680 wrote to memory of 816	3680	Build.exe	107
PID 3680 wrote to memory of 5084	3680	Build.exe	108
PID 3680 wrote to memory of 1716	3680	Build.exe	109
PID 3680 wrote to memory of 1736	3680	Build.exe	112
PID 1736 wrote to memory of 3876	1736	cmd.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\start.exe
"C:\Users\Admin\AppData\Local\Temp\start.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="Q{`MxAwWx`)Tx0" dir=in action=allow program="C:\Users\Admin\svchost.exe" enable=yes & exit
    3⤵
    PID:5004
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Chrome.exe" /tr "C:\Users\Admin\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Chrome.exe" /tr "C:\Users\Admin\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1428
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "jusched.exe" /tr "C:\Users\Admin\AppData\Local\conhost" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "jusched.exe" /tr "C:\Users\Admin\AppData\Local\conhost" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4864
- - C:\Users\Admin\svchost.exe
    "C:\Users\Admin\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- C:\Users\Admin\AppData\Local\Temp\Build.exe
  "C:\Users\Admin\AppData\Local\Temp\Build.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil.exe" cl System
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:816
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil.exe" cl Application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil.exe" cl Security
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cleanup.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\system32\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3876

C:\Users\Admin\svchost.exe
C:\Users\Admin\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Users\Admin\svchost.exe
C:\Users\Admin\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Users\Admin\svchost.exe
C:\Users\Admin\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Users\Admin\svchost.exe
C:\Users\Admin\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
Size 642B
SHA256 f9481e31897c3d9071b744e1638942b52c46858c16ccf692f5c6e109a8b092f6
MD5 e19ed69089e56bbfaaba5e5e63d0354f
SHA1 287519bf7c4ec630e4326db00809f627f927ebef
SHA512 c4a8678d28eea4c3a3adfe0324943478efabef839d3bdacb0e4c278e97ee356037c0bfd83b096952b43d81af0b7253eb7d666416e0024ce93a1c516a834fd05b
TLSH
T18EF078313365E2D889663F16282C268803BF4765E690EE0C7594A2AED9365235F212E7
MD5 SHA1 SHA512 TLSH

Submit Download

Build.exe

Path C:\Users\Admin\AppData\Local\Temp\Build.exe
Size 296KB
SHA256 a4bbc2a078cb443cb3b43acf04a4672a50e96d427b01274c5d10b57e5fd28a6d
MD5 d871573d9a9a154166d515a81ac13429
SHA1 e37616927792d8ded22bc65d0ac90469f417a785
SHA512 650939dba5b85ea52e49f865549a63e7590ec2228f73568145843fbb53f8ae47cfe623a566418a8e70d3e59e0e9f0f41302dfdc5adb4fde151b15232e1e88127
SSDEEP 6144:i59IhSQf0Ou8yegCyThvFhIpWbYNoAIIypwC+9bJjU/HIR6pUp:Hh6OTyejyThvFhIpQrAHYR/H7Up
TLSH
T182545C0127ED4659F2FF6BF8E4B1212583B1B862F83EDB8F6D4464ED1922740D950BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup.bat

Path C:\Users\Admin\AppData\Local\Temp\cleanup.bat
Size 145B
SHA256 e96f4b25b92128eab425545a6017c5f890558521dfe5e3a9a23643571259ad10
MD5 72984b305d6936646c60e90688f88410
SHA1 c81d8e2fcd4efe193bbed6672eec517aa7b6693c
SHA512 249bc2d6848233840af36d00aeeedf4d90277f448bc0ebadb736661f45c3385469d824182474d7c8efd5cd7d9684f5af2754d4c66a7e91a97c5065ba37465c30
TLSH
T115C08C0352A78AAC0444A0A70ABA718C907918896E4077D00701C4A8528242EAA82651
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 366KB
SHA256 f33b69e516c5a15b0008c496ea5990fb0b621bd49ec297dc3533e9c65ea6b2ac
MD5 7fc5c498811fb17d53a011d418388d19
SHA1 47bfc5535b016f4d8e0d0a5d53e75ae6a609af2c
SHA512 7cb707978e743a61ddac3188c794d9e12b66c4bceb116a412da38c7f462890ff643dfa77a16ede1b0c9c17bf9d5e56caef4bb28c444e514842fc5743165d1b84
SSDEEP 6144:1FRXpY29rJ9ZJBj4Z6bfgSG4Z+J5yy45AvEK2bRfMc8YnymWi0P/HAWb7OXq57UK:7bY25ZJaMsANhIgJuuXm
TLSH
T1DC84C5257FE49E40D481297ECABE3A09CB16E0F115026303374AF6A25D459EEDE2D3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp4AFA.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp4AFA.tmp.dat
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp4AFD.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp4AFD.tmp.dat
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-377-0x000000001BB30000-0x000000001BB3C000-memory.dmp

Download

memory/1608-351-0x000000001AF70000-0x000000001AF7C000-memory.dmp

Download

memory/2376-369-0x000000001AFE0000-0x000000001AFEC000-memory.dmp

Download

memory/2708-353-0x000000001D020000-0x000000001D02C000-memory.dmp

Download

memory/3680-355-0x0000024726420000-0x000002472642C000-memory.dmp

Download

memory/3680-362-0x0000024726420000-0x000002472642C000-memory.dmp

Download

memory/3680-26-0x0000024724740000-0x0000024724790000-memory.dmp

Download

memory/4012-348-0x000000001BF10000-0x000000001BF1C000-memory.dmp

Download

memory/4012-22-0x0000000000D90000-0x0000000000DF2000-memory.dmp

Download

memory/4168-0-0x0000000000A20000-0x0000000000A72000-memory.dmp

Download

memory/4168-27-0x0000000001220000-0x000000000122C000-memory.dmp

Download

memory/4168-1-0x0000000002B30000-0x0000000002B40000-memory.dmp

Download

memory/4536-356-0x000000001BBF0000-0x000000001BBFC000-memory.dmp

Download