Analysis
- user interaction
yes - max time kernel
899s - max time network
556s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
14/07/2026, 19:57
General
- Target o793zar6z2lxpbdf.exe
- Size 189KB
- Sample260714-ypf85sfs21
- SHA256 8af502fe669e9c226ebbc60e33ee5f2e273b7e5c6d0030556bbeebdbb0acce8e
Malware Config
Extracted
-
sheetrat
-
anti_virtual
false
-
certificate
wdi1t9g6h33ozkod5izzo9e
-
exclusion_wd
p5ejp$fq+1c
-
hidden_file
@2)oikr0w%tqlz(mpgg%
-
key
4axoyg936mjpta
-
path_client
qez7n&z1gb1&y%znd#g
-
path_watch_dog
669gy$!6
-
pump
l0%+p95q$jsbk7pu7%x0l@ci
-
rootkit
~uuh2.h
-
task_client
#&g5(6v
-
task_watch_dog
*_*%4@n4xy_r0a&ng9q1l
-
use_install_admin
1ni_%3pj1!xh1rj^2#75!jdr7!%
-
user_init
hb%mu23i$x2f#qy9&9@^
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\o793zar6z2lxpbdf.exe"C:\Users\Admin\AppData\Local\Temp\o793zar6z2lxpbdf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3640-0-0x000001D851180000-0x000001D8511B6000-memory.dmp
memory/3640-1-0x00007FFB11F0F000-0x00007FFB11F10000-memory.dmp
memory/3640-2-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3640-3-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3640-4-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3640-5-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3640-6-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp
memory/3640-7-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp