dracula_stealer | 8b75a5f87e2421ff44b5e10386729dd4aa09d22e0501fe9e9a140a45c94ee41d

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cwp47cnctcad2l0t.exe
Size 61KB
Sample260710-xdjdpahx71
SHA256 8b75a5f87e2421ff44b5e10386729dd4aa09d22e0501fe9e9a140a45c94ee41d
MD5 5a6a9d52741d9369f84c883d9a035ac0
SHA1 ea152dbf0f35925584315c4205836072011fa9e3
SHA512 c44f320e123a6646ee1bf1e76182c824b20ae66bbaf7479e327161be1d4969b1fc95d4c45f548fe3cfb637e5ddd4739f6907ee8b71c4109cecaa3b2a70063421
SSDEEP 1536:Gk3zKZfx0B8tKlvVvzAzywhSObnNd/Lpx7QIrNAOM3hMT:GkIfx0+tCvZlESObnNd/Lpx7lyQT
TLSH
T133535D053790AA11D9BF55BAC2D373A09734C3436942D70F1ECB90CA2F567D98E1ACEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution dracula_stealer sheetrat persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

sheetrat

Attributes

anti_virtual
false
certificate
i37xid3nohi4
exclusion_wd
true
hidden_file
true
key
mtwkip2jk
path_client
%ProgramFiles%\Service.exe
path_watch_dog
%Windows%\Bluetooth.exe
pump
false
rootkit
false
task_client
ShellHost
task_watch_dog
Wifi service
use_install_admin
true
user_init
true

Signatures

Family: Dracula, Samurai
Dracula aka Samurai is a stealer written in C#.
stealer dracula_stealer
Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Dracula aka Samurai Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/4732-94-0x000001B209A50000-0x000001B209A7C000-memory.dmp	family_dracula_stealer

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/4692-0-0x0000018BB7870000-0x0000018BB7884000-memory.dmp	family_sheetrat_v1
behavioral2/files/0x0008000000024434-6.dat	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\Service.exe"	cwp47cnctcad2l0t.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cwp47cnctcad2l0t.exe

Executes dropped EXE 3 IoCs

pid	Process
4732	Service.exe
2184	Bluetooth.exe
2932	Service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Service.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Service.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Service.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	api.ipify.org
28	icanhazip.com
62	api.ipify.org
7	api.ipify.org
8	api.ipify.org
17	api.ipify.org

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Service.exe	cwp47cnctcad2l0t.exe
File opened for modification	C:\Program Files\Service.exe	Service.exe
File opened for modification	C:\Program Files\Service.exe	Bluetooth.exe
File opened for modification	C:\Program Files\Service.exe	Service.exe
File created	C:\Program Files\Service.exe	cwp47cnctcad2l0t.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Bluetooth.exe	cwp47cnctcad2l0t.exe
File opened for modification	C:\Windows\Bluetooth.exe	cwp47cnctcad2l0t.exe
File opened for modification	C:\Windows\Bluetooth.exe	Service.exe
File opened for modification	C:\Windows\Bluetooth.exe	Bluetooth.exe
File opened for modification	C:\Windows\Bluetooth.exe	Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4048	cmd.exe
2028	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Service.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2068	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	cwp47cnctcad2l0t.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1724	schtasks.exe
4184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe
4732	Service.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	cwp47cnctcad2l0t.exe
Token: SeDebugPrivilege	4732	Service.exe
Token: SeDebugPrivilege	2184	Bluetooth.exe
Token: SeIncBasePriorityPrivilege	4732	Service.exe
Token: SeDebugPrivilege	2932	Service.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 1124	4692	cwp47cnctcad2l0t.exe	91
PID 4692 wrote to memory of 4644	4692	cwp47cnctcad2l0t.exe	92
PID 4644 wrote to memory of 4184	4644	cmd.exe	95
PID 4692 wrote to memory of 4264	4692	cwp47cnctcad2l0t.exe	96
PID 4264 wrote to memory of 1724	4264	cmd.exe	98
PID 4692 wrote to memory of 4732	4692	cwp47cnctcad2l0t.exe	100
PID 4732 wrote to memory of 4048	4732	Service.exe	108
PID 4048 wrote to memory of 2932	4048	cmd.exe	110
PID 4048 wrote to memory of 2028	4048	cmd.exe	111
PID 4048 wrote to memory of 4148	4048	cmd.exe	112
PID 4732 wrote to memory of 1704	4732	Service.exe	127
PID 1704 wrote to memory of 3692	1704	CMD.exe	129
PID 4732 wrote to memory of 3596	4732	Service.exe	130
PID 3596 wrote to memory of 3592	3596	CMD.exe	132
PID 4732 wrote to memory of 3540	4732	Service.exe	133
PID 3540 wrote to memory of 2068	3540	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Service.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Service.exe

C:\Users\Admin\AppData\Local\Temp\cwp47cnctcad2l0t.exe
"C:\Users\Admin\AppData\Local\Temp\cwp47cnctcad2l0t.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name=""P@'4<Sq4@a#4J" dir=in action=allow program="C:\Program Files\Service.exe" enable=yes & exit
  2⤵
  PID:1124
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\Service.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\Service.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4184
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Wifi service" /tr "C:\Windows\Bluetooth.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "Wifi service" /tr "C:\Windows\Bluetooth.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1724
- C:\Program Files\Service.exe
  "C:\Program Files\Service.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4732
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C chcp 65001 && netsh wlan show profiles | findstr All
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2932
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2028
  - - C:\Windows\system32\findstr.exe
      findstr All
      4⤵
      PID:4148
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c schtasks /deleTe /F /Tn "ShellHost" & exit& exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Windows\system32\schtasks.exe
      schtasks /deleTe /F /Tn "ShellHost"
      4⤵
      PID:3692
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c schtasks /deleTe /F /Tn "Wifi service" & exit& exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Windows\system32\schtasks.exe
      schtasks /deleTe /F /Tn "Wifi service"
      4⤵
      PID:3592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9B29.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Windows\system32\timeout.exe
      timeout 10 "C:\Program Files"DEL "Service.exe" /f /qCD "C:\Windows"DEL "Bluetooth.exe" /f /qCD "C:\Users\Admin\AppData\Local\Temp"DEL "tmp9B29.tmp.bat" /f /q
      4⤵
      Delays execution with timeout.exe
      PID:2068

C:\Windows\Bluetooth.exe
C:\Windows\Bluetooth.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Program Files\Service.exe
"C:\Program Files\Service.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Service.exe

Path C:\Program Files\Service.exe
Size 61KB
SHA256 8b75a5f87e2421ff44b5e10386729dd4aa09d22e0501fe9e9a140a45c94ee41d
MD5 5a6a9d52741d9369f84c883d9a035ac0
SHA1 ea152dbf0f35925584315c4205836072011fa9e3
SHA512 c44f320e123a6646ee1bf1e76182c824b20ae66bbaf7479e327161be1d4969b1fc95d4c45f548fe3cfb637e5ddd4739f6907ee8b71c4109cecaa3b2a70063421
SSDEEP 1536:Gk3zKZfx0B8tKlvVvzAzywhSObnNd/Lpx7QIrNAOM3hMT:GkIfx0+tCvZlESObnNd/Lpx7lyQT
TLSH
T133535D053790AA11D9BF55BAC2D373A09734C3436942D70F1ECB90CA2F567D98E1ACEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Service.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Service.exe.log
Size 1KB
SHA256 d049789c187b2f58c900eab10205bc037740dca8640ab40c314790fefaab66ff
MD5 f26118d675c61402c218ac6794d90a63
SHA1 ffc8d592f3ca8255ca5119eff5b576eb16ac7fac
SHA512 6f14b71dae095131053a1b590e60ccec4e14c47c745bf9d52de48988d7b93b1f50bbb6bac0222dc49e3e45def052b20be2d34e116991027718da2e0fb8eb45d0
TLSH
T17411CE723371F1D889163F072C68268417BF4724BA90EE0CB5A8626ED9364275F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

tmp4318.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp4318.tmp.dat
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp4319.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp4319.tmp.dat
Size 138KB
SHA256 442f386467789b16413f7958f769f14c38679eb213e8744201024e01b68b2a3c
MD5 8aa897064cf42beea501ead6dff932c6
SHA1 688a9adb7f2da07d584d98e444454f8cac20e3ff
SHA512 35de875c23c1703fff921288ece754a2afe37c5f2f3b378a6c05a3cc6436786f8462d6e24c42f4377fa31e6dda46c4981e6dd30dca1de596e15877f9b22c758d
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OkGVVumB3na:FnbZeMrv/hGtkGzna
TLSH
T11DD3884B3A747002DDE59A722CE050BB5E3C716D4F51A5D438B620688EF2963A23E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp9B29.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp9B29.tmp.bat
Size 165B
SHA256 fc1572b18f67141c365abe3272a46196a7939c813d0db07049b85312e06860d8
MD5 4d5aed93b74ef125b883f1c720eb18a3
SHA1 1d0f41468ba9cb94ed6775b797dd44001cbd1f5c
SHA512 5551cc26c263c6f42cfe972bd2c3b9afd34d9ec73876996857715b0ba2c715974d827bf19200cfefa68b289ff34c083dade77e4f56bee1ba1cbfc18e469b85c3
TLSH
T12CC08C02F4E28B8038463047962E14ADA08B881AEB891B2403DC860A74C4C3CE9AF388
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4692-0-0x0000018BB7870000-0x0000018BB7884000-memory.dmp

Download

memory/4692-1-0x0000018BD1F40000-0x0000018BD1F50000-memory.dmp

Download

memory/4732-94-0x000001B209A50000-0x000001B209A7C000-memory.dmp

Download

memory/4732-95-0x000001B223220000-0x000001B223270000-memory.dmp

Download