Analysis
- max time kernel
149s - max time network
144s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 11:33
General
- Target start.exe
- Size 301KB
- Sample260503-nn17tabv3n
- SHA256 e831de437b3cf279bedf39ac3d1af2295503aa4a93f45d28c5c573b5210a602c
Malware Config
Extracted
-
sheetrat
-
1.8
-
vote-ist.gl.at.ply.gg:2643
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: UnixStealer
UnixStealer is a Windows stealer written in C#.
- Detects Sheetrat obfuscated V1.8 and higher 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects UnixStealer payload 2 IoCs
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Clears Windows event logs 1 TTPs 3 IoCs
- Executes dropped EXE 7 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\start.exe"C:\Users\Admin\AppData\Local\Temp\start.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="Q{`MxAwWx`)Tx0" dir=in action=allow program="C:\Users\Admin\svchost.exe" enable=yes & exit3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Chrome.exe" /tr "C:\Users\Admin\svchost.exe" /RL HIGHEST & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "Chrome.exe" /tr "C:\Users\Admin\svchost.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "jusched.exe" /tr "C:\Users\Admin\AppData\Local\conhost" /RL HIGHEST & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "jusched.exe" /tr "C:\Users\Admin\AppData\Local\conhost" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\svchost.exe"C:\Users\Admin\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Build.exe"C:\Users\Admin\AppData\Local\Temp\Build.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cleanup.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak4⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\svchost.exeC:\Users\Admin\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\svchost.exeC:\Users\Admin\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\svchost.exeC:\Users\Admin\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\svchost.exeC:\Users\Admin\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
svchost.exe.log
Build.exe
cleanup.bat
svchost.exe
tmp9CC.tmp.dat
tmp9DF.tmp.dat
memory/564-288-0x00000000015B0000-0x00000000015C2000-memory.dmp
memory/564-287-0x00000000015A0000-0x00000000015AC000-memory.dmp
memory/728-391-0x000001B6715F0000-0x000001B671602000-memory.dmp
memory/728-402-0x000001B66FA30000-0x000001B66FA4E000-memory.dmp
memory/728-403-0x000001B66FA50000-0x000001B66FA5B000-memory.dmp
memory/728-401-0x000001B6558D0000-0x000001B6558DC000-memory.dmp
memory/728-389-0x000001B66FA30000-0x000001B66FA4E000-memory.dmp
memory/728-390-0x000001B66FA50000-0x000001B66FA5B000-memory.dmp
memory/728-289-0x000001B6558D0000-0x000001B6558DC000-memory.dmp
memory/728-25-0x000001B655410000-0x000001B655460000-memory.dmp
memory/1116-414-0x00000000015B0000-0x00000000015C2000-memory.dmp
memory/1116-413-0x00000000015A0000-0x00000000015AC000-memory.dmp
memory/1128-27-0x0000000001310000-0x000000000131C000-memory.dmp
memory/1128-1-0x0000000002B40000-0x0000000002B50000-memory.dmp
memory/1128-0-0x0000000000990000-0x00000000009E2000-memory.dmp
memory/1416-15-0x0000000000350000-0x00000000003B2000-memory.dmp
memory/1416-280-0x000000001C540000-0x000000001C54C000-memory.dmp
memory/1416-281-0x000000001C550000-0x000000001C562000-memory.dmp
memory/1772-286-0x000000001BB70000-0x000000001BB82000-memory.dmp
memory/1772-285-0x000000001BB60000-0x000000001BB6C000-memory.dmp
memory/2608-291-0x000000001C500000-0x000000001C512000-memory.dmp
memory/2608-290-0x000000001AFE0000-0x000000001AFEC000-memory.dmp
memory/3676-428-0x000000001BD40000-0x000000001BD4C000-memory.dmp
memory/3676-429-0x000000001BD50000-0x000000001BD62000-memory.dmp