sheetrat | 7872530f55a4bbd1227bbb671171ca8970de9d69504e7c8d93dd4c84f3bf16b3

General

Target
2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe
Size 11.3MB
Sample260522-e8ae6aht3v
SHA256 7872530f55a4bbd1227bbb671171ca8970de9d69504e7c8d93dd4c84f3bf16b3
MD5 b93a6de26ad849ac4deae7ff9c1c7d97
SHA1 b6472701426127fbf52498a3bf5f21dcd20d53fd
SHA512 3816593b7b3fa6a8b53075e2040d56f1eeb90bd19a5df886a86aa74b73a3cb54557fefb1219ef658322b7135369feae92a38571c76a0fb985984b1e7a43c70d4
SSDEEP 24576:s7YqyBxizDI/CgPHZviqCl2Kr/KhtlKrQxPrYWP01nTs3+oCR:ssqnz4CUB2l2G/KHlsWc69CR
TLSH
T1E0C6D619E253CF6E187713E055655FFCAEEEB14E696A1687D0F9E24332E606C80BF840
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_tcwjcmmwqyakvk discovery sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

2.6

Campaign

Sheet_tcwjcmmwqyakvk

C2

195.226.92.129:20320

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/3940-47-0x0000000000400000-0x000000000049E000-memory.dmp	family_sheetrat_v4

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsService.exe	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe

Executes dropped EXE 1 IoCs

pid	Process
2440	winupdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdateManager = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Updates\\winupdate.exe"	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdateManager = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Updates\\winupdate.exe"	winupdate.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4388 set thread context of 3940	4388	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe	82
PID 2440 set thread context of 1144	2440	winupdate.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 3940	4388	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe	82
PID 4388 wrote to memory of 3940	4388	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe	82
PID 4388 wrote to memory of 3940	4388	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe	82
PID 4388 wrote to memory of 3940	4388	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe	82
PID 4388 wrote to memory of 3940	4388	2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe	82
PID 2440 wrote to memory of 1144	2440	winupdate.exe	85
PID 2440 wrote to memory of 1144	2440	winupdate.exe	85
PID 2440 wrote to memory of 1144	2440	winupdate.exe	85
PID 2440 wrote to memory of 1144	2440	winupdate.exe	85
PID 2440 wrote to memory of 1144	2440	winupdate.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_b93a6de26ad849ac4deae7ff9c1c7d97_akira_amadey_elex_glassworm.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3940

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Updates\winupdate.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Updates\winupdate.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cryptor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cryptor_debug.log
Size 2KB
SHA256 5debbf7fb6075513cfa6f1555f7a49521d91f6b9f5570162b5eeddee60cc08f8
MD5 7134881d397ea12600c8be30054945a9
SHA1 82058fdd8b8822c28cde3cefff1d27b53bd90603
SHA512 73189a18a13c88ce27f9c522325e2e8bfe18a4c19327e2556be094c6534b3963326dafc8d9355429d614a43feda82bbf785a81b8d027de0848ebcdd6366265d3
TLSH
T16B51DA390EBC41B743994291E303BEDF5E673201AB74CD0ABA40D1C46841EBA3AE67E5
MD5 SHA1 SHA512 TLSH

Submit Download

cryptor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cryptor_debug.log
Size 430B
SHA256 6cafee1cd134905d233e32e2710cb04e5ff7ba8f6dcef2769584489c41938a10
MD5 1d2d7e71a4a65af160c43a4e17890e73
SHA1 4f37d87e3dd861678bb128e7f40353f698dc3552
SHA512 32e10b6dedaa4c49720e1021dcb8771e1540b7fd324382385a3b9dec358ecd9de0ddf205eea05d4e5d56e526fbc34a734a6a33fbaa5395c3b277d7e3d7ad4d73
TLSH
T1B0E0E53D1EBC167347550B9597877CCB6E5B36052764CD05B394C6C0205193A3DF63D6
MD5 SHA1 SHA512 TLSH

Submit Download

cryptor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cryptor_debug.log
Size 3KB
SHA256 cb789d7ebf6fae84de6117790f94dd96652b7849f4034f8d7967ba2a151d6955
MD5 0789b0323cd523fe69ed0cb6dc97ceaa
SHA1 b5cee3ec4fa9f4edb2e61a1d18f7c55a49193e8b
SHA512 984ff83619cdb7bf238a2f89b81cc3194f2ae2728348d2864d9358f9c1499ba8f490fc99afe0c9a6ba7411ab4345e6e07dde2b8ae21b7761dc6b3eb7bc938b05
TLSH
T1A051A8390EBC42B343994391E343BDDB5E5B32056B74CD0AB644D1C46481EBA3AEA7E6
MD5 SHA1 SHA512 TLSH

Submit Download

cryptor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cryptor_debug.log
Size 5KB
SHA256 1fc9da0f37c950273f4ba69ea188457ec9f4a3ef90e7e9d27d03325574ebb676
MD5 5aa88e9df5303d1d37396639f148d3c3
SHA1 96fec8546003e32e9a0f1791ad3989a9db04bffb
SHA512 b2e4b6a9e43926e4eedca6c4e0ca63c7c14a79d032141b5912c43b7e4cf00432249561e205e54bfa9048d4602a67fcb50cad196eea2b630739ed05c4d66992bd
SSDEEP 96:oRkEYBEP27qFtfvLzggx639ml2RUFZTmH3:gk2OODz3xVc+u3
TLSH
T15DB1FD794EBC41B343A94281E303BEDF9E5732016B74CD0AB640D0C96451EBA3DEA7E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winupdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Updates\winupdate.exe
Size 11.3MB
SHA256 7872530f55a4bbd1227bbb671171ca8970de9d69504e7c8d93dd4c84f3bf16b3
MD5 b93a6de26ad849ac4deae7ff9c1c7d97
SHA1 b6472701426127fbf52498a3bf5f21dcd20d53fd
SHA512 3816593b7b3fa6a8b53075e2040d56f1eeb90bd19a5df886a86aa74b73a3cb54557fefb1219ef658322b7135369feae92a38571c76a0fb985984b1e7a43c70d4
SSDEEP 24576:s7YqyBxizDI/CgPHZviqCl2Kr/KhtlKrQxPrYWP01nTs3+oCR:ssqnz4CUB2l2G/KHlsWc69CR
TLSH
T1E0C6D619E253CF6E187713E055655FFCAEEEB14E696A1687D0F9E24332E606C80BF840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3940-47-0x0000000000400000-0x000000000049E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads