Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
22/06/2026, 14:04
General
- Target WarpClient.exe
- Size 402KB
- Sample260622-rdjfsscw9p
- SHA256 dd4b5d156e943f558578df95809d66c2664551b7b1abd2c7023d7f5aedc4a6f5
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- UAC bypass 3 TTPs 4 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Executes dropped EXE 4 IoCs
- Stops running service(s) 4 TTPs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 37 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- System policy modification 1 TTPs 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WarpClient.exe"C:\Users\Admin\AppData\Local\Temp\WarpClient.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\WarpClient.exe" enable=yes & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\WarpClient.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
9a0d2954dd744091aa810f72e04fec74.dll
memory/1320-34-0x00007FFB5D8C0000-0x00007FFB5D8D0000-memory.dmp
memory/1364-28-0x00007FFB5D8C0000-0x00007FFB5D8D0000-memory.dmp
memory/1764-22-0x00007FFB5D8C0000-0x00007FFB5D8D0000-memory.dmp
memory/3500-16-0x00007FFB5D8C0000-0x00007FFB5D8D0000-memory.dmp
memory/6076-5-0x00007FFB7B020000-0x00007FFB7B9C4000-memory.dmp
memory/6076-14-0x00007FFB7B020000-0x00007FFB7B9C4000-memory.dmp
memory/6076-7-0x00007FFB7B020000-0x00007FFB7B9C4000-memory.dmp
memory/6076-8-0x00007FFB7B020000-0x00007FFB7B9C4000-memory.dmp
memory/6076-9-0x00007FFB9D780000-0x00007FFB9D9E3000-memory.dmp
memory/6076-10-0x00007FFB9C5B0000-0x00007FFB9C677000-memory.dmp
memory/6076-11-0x00007FFB9B250000-0x00007FFB9B5F1000-memory.dmp
memory/6076-6-0x00007FFB7B020000-0x00007FFB7B9C4000-memory.dmp
memory/6076-0-0x00000257870E0000-0x0000025787148000-memory.dmp
memory/6076-4-0x00007FFB7B020000-0x00007FFB7B9C4000-memory.dmp
memory/6076-3-0x00007FFB7B020000-0x00007FFB7B9C4000-memory.dmp
memory/6076-2-0x00007FFB7B020000-0x00007FFB7B9C4000-memory.dmp
memory/6076-32-0x00000257A16B0000-0x00000257A16C2000-memory.dmp
memory/6076-1-0x00007FFB7B1AF000-0x00007FFB7B1B0000-memory.dmp
memory/6076-35-0x00007FFB7B020000-0x00007FFB7B9C4000-memory.dmp