Analysis
- max time kernel
149s - max time network
93s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
22/06/2026, 17:02
General
- Target fsDkEt2orIjk41Aj.exe
- Size 577KB
- Sample260622-vkfv2aev9n
- SHA256 e4d43bf31300b430f62a124d9e1739ef5d238f4c0bfa6e678be7533849786b8f
Malware Config
Extracted
-
sheetrat
-
1.8
-
humble-driver.outray.app:24735
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat obfuscated V1.8 and higher 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fsDkEt2orIjk41Aj.exe"C:\Users\Admin\AppData\Local\Temp\fsDkEt2orIjk41Aj.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2908-0-0x0000000000540000-0x00000000005D6000-memory.dmp
memory/2908-1-0x00007FF8BF54F000-0x00007FF8BF550000-memory.dmp
memory/2908-2-0x00007FF8BF3C0000-0x00007FF8BFD64000-memory.dmp
memory/2908-3-0x00007FF8BF3C0000-0x00007FF8BFD64000-memory.dmp
memory/2908-4-0x00007FF8BF3C0000-0x00007FF8BFD64000-memory.dmp
memory/2908-5-0x00007FF8BF3C0000-0x00007FF8BFD64000-memory.dmp
memory/2908-6-0x00007FF8BF3C0000-0x00007FF8BFD64000-memory.dmp
memory/2908-7-0x00007FF8BF3C0000-0x00007FF8BFD64000-memory.dmp
memory/2908-8-0x00007FF8BF3C0000-0x00007FF8BFD64000-memory.dmp
memory/2908-9-0x00007FF8BF3C0000-0x00007FF8BFD64000-memory.dmp
memory/2908-10-0x00007FF8BF3C0000-0x00007FF8BFD64000-memory.dmp
memory/2908-11-0x00007FF8BF3C0000-0x00007FF8BFD64000-memory.dmp
memory/2908-12-0x00007FF8BF3C0000-0x00007FF8BFD64000-memory.dmp