sheetrat | ed9525a9f48e5148fbe62c94b195912783816219837c4ef96d88602417becc51

General

Target
MicrosoftEdgeUpdater.exe
Size 389KB
Sample260628-nacbjagy6l
SHA256 ed9525a9f48e5148fbe62c94b195912783816219837c4ef96d88602417becc51
MD5 e59d94c9ed615ec8f220191a711ae871
SHA1 79a112ad0cc79b66cd2104795efed70d9489d5e5
SHA512 00f23ec5b571eddeeb083e6b327011698a78ba1b2ebdf8ec4d3ad30d43659d1ac5a7acbcbc573668a1de62705b3cc6e30cfe3e8247ba5e9171d71d3bcdc56c90
SSDEEP 6144:LChKAx6C9wz4ZoeETEW1gbpJA3KpSL0pDDI9SGby:LChKc6C9ULePJA3KY0pA9SF
TLSH
T1D6845A43B7D400BAE5BE467848735615A73AB8218B72EBDF169404ED0E23BD2DD34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  MicrosoftEdgeUpdater.exe
- Size 389KB
- SHA256 ed9525a9f48e5148fbe62c94b195912783816219837c4ef96d88602417becc51
- MD5 e59d94c9ed615ec8f220191a711ae871
- SHA1 79a112ad0cc79b66cd2104795efed70d9489d5e5
- SHA512 00f23ec5b571eddeeb083e6b327011698a78ba1b2ebdf8ec4d3ad30d43659d1ac5a7acbcbc573668a1de62705b3cc6e30cfe3e8247ba5e9171d71d3bcdc56c90
- SSDEEP 6144:LChKAx6C9wz4ZoeETEW1gbpJA3KpSL0pDDI9SGby:LChKc6C9ULePJA3KY0pA9SF
- TLSH
  T1D6845A43B7D400BAE5BE467848735615A73AB8218B72EBDF169404ED0E23BD2DD34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery evasion execution exploit sheetrat persistence ransomware trojan adware spyware
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2