Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 13:10
General
- Target teruwmmcshcgn7rd.exe
- Size 210KB
- Sample260702-qectzab12q
- SHA256 577ed214515e7129485461fc1e576ff510bcd00cd8e9be46532ae6aee69bf888
Malware Config
Extracted
-
sheetrat
-
anti_virtual
/JjL8Hyr/y[X#58Z_DX4^Ouu
-
certificate
.fOAaB0\0\_FSHAkHB~\kOuu
-
hidden_file
XD,Oc:^^vx5BEPOL%BS+_Ta\\q6UyZ(,Q@U(6inkT.Ou
-
key
y4\azH*B%U8%OJE!UjyrT%uu
-
path_client
XE^.\p!PG(H^:5T5y|D0j6**\G&n0|Xx:HF[S<y@.{hu
-
path_watch_dog
aHva_{//J{\h_$*bF/QxjL3[h.HAbZac%G%m*L.hG88u
-
pump
,O[izHX^s{+a<_AQqUkBxA^U%U.\23h.&PiGfEbUq~Gu
-
rootkit
wvEE3FL3w
-
task_client
*+s2.8kr2aF5H_axkikOG,uu
-
task_watch_dog
,h#sU^{.b5rfZvpGL4./XU3EDA$FaAU&b0i|mkc@xnEu
-
user_init
q/KL~P:6~vHvkTv%.p3F:G/Skh3i%.s@k,H:{,TXO5Su
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\teruwmmcshcgn7rd.exe"C:\Users\Admin\AppData\Local\Temp\teruwmmcshcgn7rd.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/852-0-0x00007FF8B8C8F000-0x00007FF8B8C90000-memory.dmp
memory/852-1-0x00000180DC110000-0x00000180DC14A000-memory.dmp
memory/852-2-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp
memory/852-3-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp
memory/852-4-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp
memory/852-5-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp
memory/852-6-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp
memory/852-7-0x00007FF8B8B00000-0x00007FF8B94A4000-memory.dmp