Analysis
- user interaction
yes - max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
29/06/2026, 16:19
General
- Target pk1fmayn6nd93xgd.exe
- Size 312KB
- Sample260629-tsga4abs2m
- SHA256 7364317fd48494ec56a2abbc917eca4e3ac3fe751e0dec80f671be4dd3cb7e84
Malware Config
Extracted
-
sheetrat
-
1.0
-
fin.xzbvc.xyz:20100
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat obfuscated V1.8 and higher 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pk1fmayn6nd93xgd.exe"C:\Users\Admin\AppData\Local\Temp\pk1fmayn6nd93xgd.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/672-0-0x00007FFA1F94F000-0x00007FFA1F950000-memory.dmp
memory/672-1-0x0000000000CA0000-0x0000000000CF4000-memory.dmp
memory/672-2-0x00007FFA1F7C0000-0x00007FFA20164000-memory.dmp
memory/672-3-0x00007FFA1F7C0000-0x00007FFA20164000-memory.dmp
memory/672-4-0x00007FFA1F7C0000-0x00007FFA20164000-memory.dmp
memory/672-5-0x00007FFA1F7C0000-0x00007FFA20164000-memory.dmp
memory/672-6-0x00007FFA1F7C0000-0x00007FFA20164000-memory.dmp
memory/672-7-0x00007FFA1F7C0000-0x00007FFA20164000-memory.dmp
memory/672-8-0x00007FFA1F7C0000-0x00007FFA20164000-memory.dmp
memory/672-9-0x00007FFA1F7C0000-0x00007FFA20164000-memory.dmp
memory/672-10-0x00007FFA1F7C0000-0x00007FFA20164000-memory.dmp
memory/672-11-0x00007FFA1F7C0000-0x00007FFA20164000-memory.dmp
memory/672-12-0x00007FFA1F7C0000-0x00007FFA20164000-memory.dmp
memory/672-13-0x00007FFA1F7C0000-0x00007FFA20164000-memory.dmp
memory/672-14-0x000000001BE80000-0x000000001BF4A000-memory.dmp
memory/672-15-0x00007FFA1F7C0000-0x00007FFA20164000-memory.dmp