Analysis
- max time kernel
149s - max time network
115s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 10:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WinSysHelper.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
33 signatures
150 seconds
Behavioral task
behavioral2
Sample
WinSysHelper.exe
Resource
win11-20260130-en
windows11-21h2-x64
14 signatures
150 seconds
General
- Target WinSysHelper.exe
- Size 9.6MB
- Sample260504-mbr8pscs4l
- SHA256 860386e3623ad3bbab4701ea455a46bcfa6b46e201c5c3a24769fcd5441d0c83
- MD5 097bade22f4b8e8695b7340db8254e68
- SHA1 afeace1db6f878cc4d9c42d0665c70cb519e8447
- SHA512 dd9857222634e1cd60661594a5a73bb3918739cf3e5fc733d046a637cae40d3f601e13fe9762ec454717477babceb0e643e0f39f8242ba8aca5914718118da44
- SSDEEP 196608:n9wpKdysCN8+ZjE2a4qAf+f3uKYIU/gpYbeEevzzPOVYLGQjRDTitfLuaVwujTds:nSCE97aFG+WKJU/UzTOV3YRDWtaaVbG/
- TLSH T18EA6D1A5A4AEA4F0C59FBB71D935795BDB3518224F5A21EB07103E840EB3394CDB8F90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule behavioral2/memory/2768-6-0x0000000002FD0000-0x0000000003032000-memory.dmp family_sheetrat_v1 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" Program.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Program.exe - UAC bypass 3 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Program.exe - Executes dropped EXE 11 IoCs
pid Process 2768 Program.exe 3140 Process not Found 392 Process not Found 1368 Process not Found 1752 Process not Found 2728 Process not Found 3328 Process not Found 3708 Process not Found 1920 Process not Found 2104 Process not Found 2496 Process not Found - Windows security modification 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Program.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Program.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2768 Program.exe 2768 Program.exe 2768 Program.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3140 Process not Found - Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeDebugPrivilege 2768 Program.exe Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found Token: SeShutdownPrivilege 3140 Process not Found Token: SeCreatePagefilePrivilege 3140 Process not Found - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3672 wrote to memory of 2768 3672 WinSysHelper.exe 80 - System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Program.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinSysHelper.exe"C:\Users\Admin\AppData\Local\Temp\WinSysHelper.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Program.exeC:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Program.exe2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2768
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Program.exe
- Size 3.8MB
- SHA256 ae87ca9d7ae9d186021d8e4222416c775398aa64f4d3245a5f4b5ff79009527d
- MD5 925f8034d20b057ba03ce29fe64ee0a3
- SHA1 65f488491b8f502cd8cffe6d1e4e786cd96e7ab3
- SHA512 b7d6c1357d884d0e92289b64c7e23d6ab6e6e0b17695f9ec91d9167ab537bb00a4e03a8ea5f5d7c209ddc326bdba5525d0551bbe3a68507c9b3451ba882c4005
- SSDEEP 6144:1pS6we7lT44CD8tra9PTIOFA/znnnhN7jYKsdKyPMtDAvlTaC5MaWD3ff/9X2B7V:1YX/yYXERCfd+/CE9qtYs+gzvKqhgYX
- TLSH T1350623A702F4EB8CC766CB3444E3E4F15F7B6112562B4F6E4C985478018AE688EE1B5F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$77temp\18870316-f876-4a05-84b7-9d71ea8f8367.dll
- Size 147KB
- SHA256 ff95571a4b3880be2807cad8875ee6ccd0b2b705caf0d4d0d0f56950dd78ee5a
- MD5 6295c384c45ef898b40608f7af8155db
- SHA1 75111839c370518271e1b625f506062f7ab31c3a
- SHA512 eea64a94234dff73912699c59e1356579509e2bcffe22b066f65843d230875a7d9fb5f6c75a7a0c81395cdd14e0f6e72bff3a7f39ca455f3d7026edd54b4c801
- SSDEEP 3072:n3+8MsFRgZM1a+UwrL0vxmQ4ktFN6y3Fb1:n3KpSL0pD
- TLSH T11FE30807B6E500FBD8B6813585536A19B7BAF4540322EBEB825449FD0F2BBD1ED39B10
- MD5 SHA1 SHA512 SSDEEP TLSH