sheetrat | 5ac05d0e90e2a25cb84b71f6e69c0eaa696f28da445ff0d113bb579d46ca7698

General

Target
x5ac05d0e90e2a25cb84b71f6e69c0eaa696f28da445ff0d113bb579d46ca7698.exe
Size 547KB
Sample260701-chkgbses71
SHA256 5ac05d0e90e2a25cb84b71f6e69c0eaa696f28da445ff0d113bb579d46ca7698
MD5 f8aadf44573332411397c10a5c515d73
SHA1 9bbbcdb7b947e952405edb847364469d6c47f036
SHA512 03ed39194e0d865eb6f76e03c016852aafa16ff1ffd64206d88b9aad7f02c2ce0608dbfb51e8e48ec9a1de6d1115d9e318912458d2684fcc0f541acfb028cb3b
SSDEEP 12288:TXXVnmrgFzgFfWjvAglV/Y47a9LhBuOCIeGn5hwIjT5yCK:THVqWvJQj9QBMvH5VK
TLSH
T11BC40127B76620FAE167823CC5A51656F77178350B619BEF03A443762F232E16D3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution sheetrat persistence trojan

Malware Config

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x000e00000001c630-4.dat	family_sheetrat_v1
behavioral2/memory/6048-8-0x0000025A80880000-0x0000025A808E6000-memory.dmp	family_sheetrat_v1

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	tmp8865.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	WlidSvcGroupconfig.exe

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	tmp8865.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	tmp8865.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	tmp8865.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	tmp8865.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WlidSvcGroupconfig.exe

Executes dropped EXE 3 IoCs

pid	Process
6048	tmp8865.exe
5520	WlidSvcGroupconfig.exe
5800	WlidSvcGroupconfig.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WlidSvcGroupconfig.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WlidSvcGroupconfig.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tmp8865.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	tmp8865.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe	tmp8865.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4776	schtasks.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	6048	tmp8865.exe
Token: SeDebugPrivilege	5520	WlidSvcGroupconfig.exe
Token: SeDebugPrivilege	5800	WlidSvcGroupconfig.exe
Token: SeIncBasePriorityPrivilege	5520	WlidSvcGroupconfig.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 6048	4260	x5ac05d0e90e2a25cb84b71f6e69c0eaa696f28da445ff0d113bb579d46ca7698.exe	89
PID 6048 wrote to memory of 1640	6048	tmp8865.exe	91
PID 6048 wrote to memory of 6200	6048	tmp8865.exe	92
PID 6048 wrote to memory of 6228	6048	tmp8865.exe	93
PID 6200 wrote to memory of 3880	6200	CMD.exe	97
PID 6228 wrote to memory of 4776	6228	cmd.exe	98
PID 6048 wrote to memory of 5520	6048	tmp8865.exe	99
PID 5520 wrote to memory of 7076	5520	WlidSvcGroupconfig.exe	102
PID 7076 wrote to memory of 5604	7076	CMD.exe	104

System policy modification 1 TTPs 18 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	tmp8865.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	tmp8865.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	tmp8865.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	tmp8865.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	tmp8865.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	tmp8865.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	WlidSvcGroupconfig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WlidSvcGroupconfig.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\x5ac05d0e90e2a25cb84b71f6e69c0eaa696f28da445ff0d113bb579d46ca7698.exe
"C:\Users\Admin\AppData\Local\Temp\x5ac05d0e90e2a25cb84b71f6e69c0eaa696f28da445ff0d113bb579d46ca7698.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Temp\tmp8865.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8865.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:6048
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe" enable=yes & exit
    3⤵
    PID:1640
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c schtasks /delete /F /TN "Runtime Broker" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6200
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /F /TN "Runtime Broker"
      4⤵
      PID:3880
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /tn "Runtime Broker" /tr "C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6228
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /tn "Runtime Broker" /tr "C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4776
- - C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe
    "C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:5520
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c schtasks /delete /F /TN "Runtime Broker" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:7076
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /F /TN "Runtime Broker"
        5⤵
        
        PID:5604

C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe
C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp8865.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp8865.exe
Size 388KB
SHA256 a95bbd75f40d5bcd017ad594071f44168a50facbc79ccd5b809b051bff8dae7e
MD5 d3b251d2eae0c92a63946a969fae1ca8
SHA1 7f7100df77412268afea771be92fd9ba6bde8fe2
SHA512 98f183bd9c89743627560ffa9e32f3c8317b4f595bef6e1f0e2c35d700500aeeab6440125a1e2e5b1f255de5f39833439f9179aabbf9084135fbffd1f4f45ec2
SSDEEP 6144:MFG2ITF9wz4ZoeETEW1gbpJA3KpSL0pDCTupGbe:MFGfTF9ULePJA3KY0pKupZ
TLSH
T176845A43B7D400B9E5BE4A7848735615A73AB8218B72EBDF169404ED0E23BC6DD34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6048-8-0x0000025A80880000-0x0000025A808E6000-memory.dmp

Download

memory/6048-9-0x00007FFE01EDF000-0x00007FFE01EE0000-memory.dmp

Download

memory/6048-10-0x00007FFE01D50000-0x00007FFE026F4000-memory.dmp

Download

memory/6048-11-0x00007FFE01D50000-0x00007FFE026F4000-memory.dmp

Download

memory/6048-12-0x00007FFE01D50000-0x00007FFE026F4000-memory.dmp

Download

memory/6048-13-0x00007FFE01D50000-0x00007FFE026F4000-memory.dmp

Download

memory/6048-14-0x00007FFE01D50000-0x00007FFE026F4000-memory.dmp

Download

memory/6048-15-0x00007FFE01D50000-0x00007FFE026F4000-memory.dmp

Download

memory/6048-34-0x00007FFE01D50000-0x00007FFE026F4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads