sheetrat | 4877e862093ac7973535dea976049f527dea98c14223519b688f973a6f1ed668

General

Target
4877e862093ac7973535dea976049f527dea98c14223519b688f973a6f1ed668
Size 375KB
Sample260708-kjlpsadv51
SHA256 4877e862093ac7973535dea976049f527dea98c14223519b688f973a6f1ed668
MD5 9878153eb68f2fc8891ab8bffd691e1a
SHA1 032035e851be56d020bed4c49ed0b71ebba56f2c
SHA512 cfab37f62e5404b9689917e7d95e9e5cd24b50abb16c7074e9c655d75e09df53159420e55dfa675d1c9178265f7183f9006e0e487d254a6f00ecca797b5d6e53
SSDEEP 6144:V0C68j9wz4ZoeETEW1gbpJA3KpSL0pDsmKbD:V0C629ULePJA3KY0pDQ
TLSH
T121845A43B7D000BAE5BE463944735A19A73AF8114B62EBDF169404ED0E27BC6DD38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  4877e862093ac7973535dea976049f527dea98c14223519b688f973a6f1ed668
- Size 375KB
- SHA256 4877e862093ac7973535dea976049f527dea98c14223519b688f973a6f1ed668
- MD5 9878153eb68f2fc8891ab8bffd691e1a
- SHA1 032035e851be56d020bed4c49ed0b71ebba56f2c
- SHA512 cfab37f62e5404b9689917e7d95e9e5cd24b50abb16c7074e9c655d75e09df53159420e55dfa675d1c9178265f7183f9006e0e487d254a6f00ecca797b5d6e53
- SSDEEP 6144:V0C68j9wz4ZoeETEW1gbpJA3KpSL0pDsmKbD:V0C629ULePJA3KY0pDQ
- TLSH
  T121845A43B7D000BAE5BE463944735A19A73AF8114B62EBDF169404ED0E27BC6DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution sheetrat persistence trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2