sheetrat | 7872530f55a4bbd1227bbb671171ca8970de9d69504e7c8d93dd4c84f3bf16b3

General

Target
2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe
Size 11.3MB
Sample260522-e8ae6aht3v
SHA256 7872530f55a4bbd1227bbb671171ca8970de9d69504e7c8d93dd4c84f3bf16b3
MD5 b93a6de26ad849ac4deae7ff9c1c7d97
SHA1 b6472701426127fbf52498a3bf5f21dcd20d53fd
SHA512 3816593b7b3fa6a8b53075e2040d56f1eeb90bd19a5df886a86aa74b73a3cb54557fefb1219ef658322b7135369feae92a38571c76a0fb985984b1e7a43c70d4
SSDEEP 24576:s7YqyBxizDI/CgPHZviqCl2Kr/KhtlKrQxPrYWP01nTs3+oCR:ssqnz4CUB2l2G/KHlsWc69CR
TLSH
T1E0C6D619E253CF6E187713E055655FFCAEEEB14E696A1687D0F9E24332E606C80BF840
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_tcwjcmmwqyakvk discovery sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

2.6

Campaign

Sheet_tcwjcmmwqyakvk

C2

195.226.92.129:20320

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/1748-47-0x0000000000400000-0x000000000049E000-memory.dmp	family_sheetrat_v4

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsService.exe	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe

Executes dropped EXE 1 IoCs

pid	Process
1824	winupdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdateManager = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Updates\\winupdate.exe"	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdateManager = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Updates\\winupdate.exe"	winupdate.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 1748	3920	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe	90
PID 1824 set thread context of 4884	1824	winupdate.exe	93

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 1748	3920	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe	90
PID 3920 wrote to memory of 1748	3920	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe	90
PID 3920 wrote to memory of 1748	3920	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe	90
PID 3920 wrote to memory of 1748	3920	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe	90
PID 3920 wrote to memory of 1748	3920	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe	90
PID 1824 wrote to memory of 4884	1824	winupdate.exe	93
PID 1824 wrote to memory of 4884	1824	winupdate.exe	93
PID 1824 wrote to memory of 4884	1824	winupdate.exe	93
PID 1824 wrote to memory of 4884	1824	winupdate.exe	93
PID 1824 wrote to memory of 4884	1824	winupdate.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1748

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Updates\winupdate.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Updates\winupdate.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cryptor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cryptor_debug.log
Size 2KB
SHA256 fcb9af15f689ce996a110aef61473815c7b7c5d65cccd27c4836659b18c151f8
MD5 8c74b4c4ea09c4acb008e3650f6b8288
SHA1 95e01ff994d348a6a55d18e4e8db48cab1608551
SHA512 a8ca1395339db24f28af0dfc3936fb16cc9c35ee16ffb5377adc73cf1b7b28e9bddbf07f4659c5e75fa30e7263428da5c1db7a218b9292fe36f8604b04f4d224
TLSH
T14841CA295EBC417343994381E343BEDB1E6733116B70CE4AA650D4C06881EBA3DEA3E6
MD5 SHA1 SHA512 TLSH

Submit Download

cryptor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cryptor_debug.log
Size 430B
SHA256 781c14962e05490d433643f051a854e44a187c9066471c472ac3024effad87e8
MD5 a73861876d72a97a3e57e800efcfba55
SHA1 5c731c351ea316825340cf2f1038cce86a045460
SHA512 9a11096c171413f376e2bc462a3197dedd52b7cab9af680e56fa1303dde93efe96516748f4c2866cceffe768d01d34699e0ce06d135a1d13434d592096b0eb56
TLSH
T1E1E0653D1EBC163303150B8583837CCB2E4B32052364CD01B394C2C0204193A3DF63D9
MD5 SHA1 SHA512 TLSH

Submit Download

cryptor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cryptor_debug.log
Size 3KB
SHA256 46e3c9a92e2e0a0f97664126ccf9ab5bd5ba9f6f007d29e85d14ef181710d965
MD5 5354967d5d91f410c3f55bb05b171d13
SHA1 e017b96f6345d7cd5b4edd7c7df745cfa8fca26f
SHA512 a8bc03ba61c92ada3b1d536623a2d80916196453f60054737ad31b2c272108dc2bcbbead95d2500df2d36f4b720272c346bd2dd5839fd8293c093f65342a852d
TLSH
T1BD51B9391EBC417343994381E343BDDB5E6732016B64CE0AF75091C46482EBA3DEA3E5
MD5 SHA1 SHA512 TLSH

Submit Download

cryptor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cryptor_debug.log
Size 5KB
SHA256 7487fffa8e620e1fd000c29158f960eb6426d12eb9ef9e55d3845d04ded56719
MD5 23f7122af0d498c5de5a02fe6addf31f
SHA1 3ccdd3251a952c71b8b9e6b94f7dfc17acb4f834
SHA512 4226b9201aa688de473f402eb679c88a6f12c6e1e05469087374a1a7184c111c63fd788f6444d88a7918154986d7cd16f09db59695d13fd0560baa132f0c549c
SSDEEP 96:oJkHxYPPl2OPFXOr2sgx279mf2RUFZyr3:gkuc6y2DxD++g3
TLSH
T17AB1ED794EBC51B343A94281E343BDDB9E6332016B74CE0AF64090C96491DBA3DEA3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winupdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Updates\winupdate.exe
Size 11.3MB
SHA256 7872530f55a4bbd1227bbb671171ca8970de9d69504e7c8d93dd4c84f3bf16b3
MD5 b93a6de26ad849ac4deae7ff9c1c7d97
SHA1 b6472701426127fbf52498a3bf5f21dcd20d53fd
SHA512 3816593b7b3fa6a8b53075e2040d56f1eeb90bd19a5df886a86aa74b73a3cb54557fefb1219ef658322b7135369feae92a38571c76a0fb985984b1e7a43c70d4
SSDEEP 24576:s7YqyBxizDI/CgPHZviqCl2Kr/KhtlKrQxPrYWP01nTs3+oCR:ssqnz4CUB2l2G/KHlsWc69CR
TLSH
T1E0C6D619E253CF6E187713E055655FFCAEEEB14E696A1687D0F9E24332E606C80BF840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1748-47-0x0000000000400000-0x000000000049E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads