sheetrat | e6e713954e02f921374deed78cbccf0f84560f4b72506fe7a9de1c97626d82e7

General

Target
NursultanCrack.exe
Size 11.3MB
Sample260701-vbza1scs3v
SHA256 e6e713954e02f921374deed78cbccf0f84560f4b72506fe7a9de1c97626d82e7
MD5 ca5e354157df6cf00a2511d81f568b1f
SHA1 333bee777929d42fdf408dc5ae7c6658bde91461
SHA512 e66125b1770fdab60a2fb55228ef416ade0a65c07da3c5833705e361dc4bcd70c35e01c2cc9dce69e1f21b76c264abf5b8bbbdfeda57258ed33c06312fb95d51
SSDEEP 196608:Knie+zx78AZDWnBH40lbdHCQfmgjuKNXbWXQQ07gcggbD8r6flk:vHx7vZmBY05cemsdXS07gcH6
TLSH
T13BC633D3AC60FCF8CC0943F1963F1509097B4EE9B7EBD08F3559366EC5A669A848A41C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  NursultanCrack.exe
- Size 11.3MB
- SHA256 e6e713954e02f921374deed78cbccf0f84560f4b72506fe7a9de1c97626d82e7
- MD5 ca5e354157df6cf00a2511d81f568b1f
- SHA1 333bee777929d42fdf408dc5ae7c6658bde91461
- SHA512 e66125b1770fdab60a2fb55228ef416ade0a65c07da3c5833705e361dc4bcd70c35e01c2cc9dce69e1f21b76c264abf5b8bbbdfeda57258ed33c06312fb95d51
- SSDEEP 196608:Knie+zx78AZDWnBH40lbdHCQfmgjuKNXbWXQQ07gcggbD8r6flk:vHx7vZmBY05cemsdXS07gcH6
- TLSH
  T13BC633D3AC60FCF8CC0943F1963F1509097B4EE9B7EBD08F3559366EC5A669A848A41C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation ransomware trojan exploit
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2