Analysis
- max time kernel
1198s - max time network
1202s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
20/06/2026, 06:08
General
- Target 111111.exe
- Size 506KB
- Sample260620-gv9zzaew9w
- SHA256 3a6b77fd02102ec84b7028e24a310244a63d13bcdd25bed89570280367e5a727
Malware Config
Extracted
-
sheetrat
-
1.8
-
144.31.30.24:50235
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat obfuscated V1.8 and higher 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Start PowerShell.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\111111.exe"C:\Users\Admin\AppData\Local\Temp\111111.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpDEDC.tmp.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpDEDC.tmp.exe"'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpDEDC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDEDC.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_an5fjwrp.yjm.ps1
tmpDEDC.tmp.exe
memory/1368-6-0x00007FFC2D980000-0x00007FFC2E324000-memory.dmp
memory/1368-10-0x000000001C720000-0x000000001C7EA000-memory.dmp
memory/1368-4-0x00007FFC2D980000-0x00007FFC2E324000-memory.dmp
memory/1368-5-0x00007FFC2D980000-0x00007FFC2E324000-memory.dmp
memory/1368-0-0x0000000000A20000-0x0000000000AA4000-memory.dmp
memory/1368-7-0x00007FFC2D980000-0x00007FFC2E324000-memory.dmp
memory/1368-8-0x00007FFC2D980000-0x00007FFC2E324000-memory.dmp
memory/1368-16-0x0000000002B70000-0x0000000002B7A000-memory.dmp
memory/1368-15-0x000000001BCD0000-0x000000001BD56000-memory.dmp
memory/1368-11-0x0000000002B50000-0x0000000002B6E000-memory.dmp
memory/1368-3-0x00007FFC2D980000-0x00007FFC2E324000-memory.dmp
memory/1368-14-0x0000000001180000-0x0000000001206000-memory.dmp
memory/1368-9-0x00007FFC2D980000-0x00007FFC2E324000-memory.dmp
memory/1368-19-0x0000000002B80000-0x0000000002B8C000-memory.dmp
memory/1368-2-0x00007FFC2D980000-0x00007FFC2E324000-memory.dmp
memory/1368-36-0x000000001BAD0000-0x000000001BAE2000-memory.dmp
memory/1368-1-0x00007FFC2DB0F000-0x00007FFC2DB10000-memory.dmp
memory/4984-26-0x0000019FA3B10000-0x0000019FA3B32000-memory.dmp
memory/5112-31-0x00000282AE640000-0x00000282AEEFA000-memory.dmp
memory/5112-32-0x00000282AF340000-0x00000282AF341000-memory.dmp
memory/5112-33-0x00000282B0C30000-0x00000282B0CE0000-memory.dmp
memory/5112-34-0x00000282C96F0000-0x00000282C9766000-memory.dmp
memory/5112-35-0x00000282CAAC0000-0x00000282CAC94000-memory.dmp