Analysis
- max time kernel
36s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
22/05/2026, 16:28
General
- Target Phantom_Stealer_64Bits_Build/Builder.exe
- Size 389KB
- Sample260522-ty57eahz3q
- SHA256 93cf31dc003c0eede920a0fec6d04e119ff5a5a149c9f4d45b19861e40f16fe6
Malware Config
Extracted
-
sheetrat
-
1.8
-
perepereshing-30754.portmap.host:30754
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat obfuscated V1.8 and higher 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Phantom_Stealer_64Bits_Build\Builder.exe"C:\Users\Admin\AppData\Local\Temp\Phantom_Stealer_64Bits_Build\Builder.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Builder.exe"C:\Users\Admin\AppData\Local\Temp\Builder.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Velocittty.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Velocittty.exe"C:\Users\Admin\AppData\Local\Temp\Velocittty.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Velocittty.exeC:\Users\Admin\AppData\Local\Temp\Velocittty.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Velocittty.exe.log
Builder.exe
Velocittty.exe
__PSScriptPolicyTest_cg4iz4em.uvf.ps1
memory/4612-0-0x0000000000DA0000-0x0000000000E08000-memory.dmp
memory/4612-1-0x000000001B940000-0x000000001B950000-memory.dmp
memory/4736-31-0x000001BC7EF80000-0x000001BC7EF8A000-memory.dmp
memory/4736-34-0x000001BC7F020000-0x000001BC7F03A000-memory.dmp
memory/4736-29-0x000001BC182E0000-0x000001BC182FC000-memory.dmp
memory/4736-30-0x000001BC18300000-0x000001BC183B3000-memory.dmp
memory/4736-21-0x000001BC7F0B0000-0x000001BC7FB72000-memory.dmp
memory/4736-32-0x000001BC7EFF0000-0x000001BC7F00C000-memory.dmp
memory/4736-33-0x000001BC7EF90000-0x000001BC7EF9A000-memory.dmp
memory/4736-22-0x000001BC7F0B0000-0x000001BC7FB72000-memory.dmp
memory/4736-35-0x000001BC183C0000-0x000001BC183C8000-memory.dmp
memory/4736-36-0x000001BC183D0000-0x000001BC183D6000-memory.dmp
memory/4736-37-0x000001BC7EFD0000-0x000001BC7EFDA000-memory.dmp
memory/4736-40-0x000001BC7F0B0000-0x000001BC7FB72000-memory.dmp
memory/4736-20-0x000001BC7EFA0000-0x000001BC7EFC2000-memory.dmp
memory/4736-13-0x000001BC7F87A000-0x000001BC7F87B000-memory.dmp
memory/5956-53-0x0000000000F80000-0x0000000001008000-memory.dmp