sheetrat | f97af03836cf012cab1e2dabdb5079fb9c13faac9dd09bbd771332dd54ad572b

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/06/2026, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kw96deakv72l1jlw.exe
Size 198KB
Sample260619-xrtftab16y
SHA256 f97af03836cf012cab1e2dabdb5079fb9c13faac9dd09bbd771332dd54ad572b
MD5 884b07b9cd6b3a04c1ab96a8d69f83d8
SHA1 9da6cf4a1a8017b40474f7453109cb2fe03167f9
SHA512 6e5b37c08c9ecb0c21c8d90e40b32d16cd0f8c2a3310f667c7a9c305b68e94028d18a5f60991e0a8f70c39a4333d50380b5609758cd3d0cf264439232d1f2f55
SSDEEP 6144:SjasIhFBC//2C9dX3MCar0jm49OMjbJwlD:G/Ia2iB3Ir0jb9OMClD
TLSH
T1AE14F1497BD4D611C47E0279D7F6B385C734B2833A81D3032ECAA1C55E9B7C6A498CEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura execution sheetrat packer persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Attributes

anti_virtual
false
certificate
vjli11lxjjzegjtjb6kfgmpvl9bcb
exclusion_wd
true
hidden_file
true
key
ndkjx53m6l
path_client
%ProgramFiles%\Search.exe
path_watch_dog
%Windows%\xSearcher.exe
pump
false
rootkit
0suevo9zupxj6hw6pzydhwsk2dcbl3
task_client
ShellHost
task_watch_dog
CookieManager
use_install_admin
true
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/5488-1-0x000001B4212E0000-0x000001B421316000-memory.dmp	family_sheetrat_v1
behavioral2/files/0x000d00000001c665-11.dat	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\Search.exe"	kw96deakv72l1jlw.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 4 IoCs

pid	Process
6792	xSearcher.exe
6308	Search.exe
1536	tmpC6B6.tmp.exe
4740	tmpD790.tmp.exe

Loads dropped DLL 8 IoCs

pid	Process
6792	xSearcher.exe
6308	Search.exe
2224	Process not Found
6820	powershell.exe
1536	tmpC6B6.tmp.exe
1760	Process not Found
1460	powershell.exe
4740	tmpD790.tmp.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org
3	api.ipify.org
4	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
6820	powershell.exe
1460	powershell.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/memory/6308-109-0x000001E96A970000-0x000001E96A9E8000-memory.dmp	costura

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Search.exe	kw96deakv72l1jlw.exe
File opened for modification	C:\Program Files\Search.exe	kw96deakv72l1jlw.exe
File opened for modification	C:\Program Files\Search.exe	xSearcher.exe
File opened for modification	C:\Program Files\Search.exe	Search.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\xSearcher.exe	kw96deakv72l1jlw.exe
File opened for modification	C:\Windows\xSearcher.exe	kw96deakv72l1jlw.exe
File created	C:\Windows\xdwd.dll	kw96deakv72l1jlw.exe
File opened for modification	C:\Windows\xdwd.dll	kw96deakv72l1jlw.exe
File opened for modification	C:\Windows\xSearcher.exe	xSearcher.exe
File opened for modification	C:\Windows\xSearcher.exe	Search.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5632	schtasks.exe
1332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
6792	xSearcher.exe
6792	xSearcher.exe
6308	Search.exe
6308	Search.exe
6820	powershell.exe
6820	powershell.exe
6820	powershell.exe
6820	powershell.exe
1536	tmpC6B6.tmp.exe
1536	tmpC6B6.tmp.exe
1460	powershell.exe
1460	powershell.exe
1460	powershell.exe
1460	powershell.exe
4740	tmpD790.tmp.exe
4740	tmpD790.tmp.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5488	kw96deakv72l1jlw.exe
Token: SeDebugPrivilege	6792	xSearcher.exe
Token: SeDebugPrivilege	6308	Search.exe
Token: SeIncBasePriorityPrivilege	6308	Search.exe
Token: SeDebugPrivilege	6820	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5488 wrote to memory of 5644	5488	kw96deakv72l1jlw.exe	91
PID 5488 wrote to memory of 2940	5488	kw96deakv72l1jlw.exe	92
PID 2940 wrote to memory of 5632	2940	cmd.exe	95
PID 5488 wrote to memory of 6744	5488	kw96deakv72l1jlw.exe	96
PID 6744 wrote to memory of 1332	6744	cmd.exe	98
PID 5488 wrote to memory of 6308	5488	kw96deakv72l1jlw.exe	102
PID 6308 wrote to memory of 4712	6308	Search.exe	104
PID 4712 wrote to memory of 6820	4712	cmd.exe	106
PID 6820 wrote to memory of 1536	6820	powershell.exe	107
PID 6308 wrote to memory of 6928	6308	Search.exe	108
PID 6928 wrote to memory of 1460	6928	cmd.exe	110
PID 1460 wrote to memory of 4740	1460	powershell.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\kw96deakv72l1jlw.exe
"C:\Users\Admin\AppData\Local\Temp\kw96deakv72l1jlw.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="^TZwLAM!LZ7%L*" dir=in action=allow program="C:\Program Files\Search.exe" enable=yes & exit
  2⤵
  PID:5644
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\Search.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\Search.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5632
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\xSearcher.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6744
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\xSearcher.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1332
- C:\Program Files\Search.exe
  "C:\Program Files\Search.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6308
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpC6B6.tmp.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpC6B6.tmp.exe"'
      4⤵
      Loads dropped DLL
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\tmpC6B6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC6B6.tmp.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1536
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpD790.tmp.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpD790.tmp.exe"'
      4⤵
      Loads dropped DLL
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\tmpD790.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD790.tmp.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4740

C:\Windows\xSearcher.exe
C:\Windows\xSearcher.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Search.exe

Path C:\Program Files\Search.exe
Size 198KB
SHA256 f97af03836cf012cab1e2dabdb5079fb9c13faac9dd09bbd771332dd54ad572b
MD5 884b07b9cd6b3a04c1ab96a8d69f83d8
SHA1 9da6cf4a1a8017b40474f7453109cb2fe03167f9
SHA512 6e5b37c08c9ecb0c21c8d90e40b32d16cd0f8c2a3310f667c7a9c305b68e94028d18a5f60991e0a8f70c39a4333d50380b5609758cd3d0cf264439232d1f2f55
SSDEEP 6144:SjasIhFBC//2C9dX3MCar0jm49OMjbJwlD:G/Ia2iB3Ir0jb9OMClD
TLSH
T1AE14F1497BD4D611C47E0279D7F6B385C734B2833A81D3032ECAA1C55E9B7C6A498CEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b4d2605b3421911dd23b203ceda3c674f6e4c59b93f9c9d10ef548e2461a3151
MD5 e6a8d33648820752b04254098d837621
SHA1 a24310e320c2b6dddfb808db69565d1ca0276e6d
SHA512 01180b5c095bfa465388173f8e0b8d234982aa4e1589058889727894e15834c54b89c46f7ba8d26582841986db1e038fbe38f813ac75419995eb7e0891a6a432
TLSH
T114115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D144B83F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

FRPlaucher.exe

Path C:\Users\Admin\AppData\Local\Temp\FRPlaucher.exe
Size 8.7MB
SHA256 37c02fed5dcc9834a85ee7beb813aff4cd5578f213d93a0063c970975290f689
MD5 10d3b96b6be0af22a5ca2d8e04cd8ec5
SHA1 8c3cc204cfbc1a37657003b62de7adc1f0124f1c
SHA512 27544d681e9f19bd2baa5e3a6e6cb73169fb627260d09340d5d72c41071493a712153fe79155d7237c85ef73eeaf024c8cd6e51b5f02f5a44378dc26148e0bc7
SSDEEP 98304:JpZmFQPPE6EITq+GSGaEb2AQCApN5ANdL5biUkZoBvg6Xxu1HR1/tnQ5:JpZmQP86EiPWbfqNqNdL1iUau4TO
TLSH
T1DC968C03EC9559E9C1A9A330C9A38253BA717C485B3263D72B50F7386FB7BC06A78754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpC6B6.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpC6B6.tmp.exe
Size 5.0MB
SHA256 a838be81f554f50bd745aa544d6d4cbfbb0b726eb673ac18e9f06542a61318e2
MD5 9e666e086abfd2b022ad9a66914ffd64
SHA1 d44b6615c1364db61bba586351caec46340abc71
SHA512 e7f986d41d9c0f9f5afb00c57a93dfbe948024f65722291bfba8cd565dfb2ebd935923dfa26e5368c5c59fe66fc111eca561f72b6c2c1b26525869326d996489
SSDEEP 98304:bXiIquHe2wOOQbgACStTPr/OZsJAHlEkfiuMo4AA48uxnbsgiRAB8wcBZl5rg:bXdR+2wO9dpSP0uPZJxbsgiOWLrg
TLSH
T18C3633A003F88F72D02C11F70DC101EA8EEF91AA5A715D58794DAB7B91C99961E0E1FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1536-124-0x0000000000260000-0x000000000076C000-memory.dmp

Download

memory/5488-108-0x00007FFE4CD70000-0x00007FFE4D714000-memory.dmp

Download

memory/5488-5-0x00007FFE4CD70000-0x00007FFE4D714000-memory.dmp

Download

memory/5488-1-0x000001B4212E0000-0x000001B421316000-memory.dmp

Download

memory/5488-4-0x00007FFE4CD70000-0x00007FFE4D714000-memory.dmp

Download

memory/5488-3-0x00007FFE4CD70000-0x00007FFE4D714000-memory.dmp

Download

memory/5488-2-0x00007FFE4CD70000-0x00007FFE4D714000-memory.dmp

Download

memory/5488-0-0x00007FFE4CEFF000-0x00007FFE4CF00000-memory.dmp

Download

memory/6308-109-0x000001E96A970000-0x000001E96A9E8000-memory.dmp

Download

memory/6308-110-0x000001E96AAF0000-0x000001E96AB3C000-memory.dmp

Download

memory/6308-112-0x000001E96AB40000-0x000001E96AB8A000-memory.dmp

Download

memory/6308-111-0x000001E96A5F0000-0x000001E96A61A000-memory.dmp

Download

memory/6308-113-0x000001E900FE0000-0x000001E900FEC000-memory.dmp

Download

memory/6820-117-0x000002D1E3740000-0x000002D1E3762000-memory.dmp

Download