Resubmissions
04/07/2026, 15:04
260704-sf27cscw8m1004/07/2026, 14:41
260704-r2qvsagv6s1004/07/2026, 14:30
260704-rvg93ags811004/07/2026, 14:25
260704-rrbccab14n1004/07/2026, 14:20
260704-rnqb4af15z1004/07/2026, 14:17
260704-rl1p2sf14s10Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 14:25
General
- Target 0qbuoyx1abygv4ey.exe
- Size 373KB
- Sample260704-rrbccab14n
- SHA256 b734bfdaad9f9f745379d1231bb15715ae227dfb52b637a7d51624a7a8d16646
Malware Config
Extracted
-
sheetrat
-
1.8
-
ola0mn4tzk.localto.net:3722
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat obfuscated V1.8 and higher 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Executes dropped EXE 4 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0qbuoyx1abygv4ey.exe"C:\Users\Admin\AppData\Local\Temp\0qbuoyx1abygv4ey.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="I7!e\;fF\!m/\(" dir=in action=allow program="C:\Windows\System32\Defender.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\Defender.exe"C:\Windows\System32\Defender.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Defender.exeC:\Windows\System32\Defender.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Defender.exe"C:\Windows\System32\Defender.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Defender.exe"C:\Windows\System32\Defender.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Defender.exe
memory/5904-19-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/5904-1-0x00007FF82F48F000-0x00007FF82F490000-memory.dmp
memory/5904-2-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/5904-3-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/5904-4-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/5904-5-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/5904-6-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/5904-7-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/5904-8-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/5904-0-0x0000000000300000-0x0000000000364000-memory.dmp
memory/6468-17-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/6468-18-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/6468-20-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/6468-21-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/6468-22-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/6468-23-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/6468-24-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/6468-26-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp
memory/6468-27-0x000000001DBD0000-0x000000001DC9A000-memory.dmp
memory/6468-28-0x00007FF82F300000-0x00007FF82FCA4000-memory.dmp