Overview

overview

10

Static

static

10

1ennl6nydr6tmzje.exe

windows10-2004-x64

10

1ennl6nydr6tmzje.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 10:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1ennl6nydr6tmzje.exe
  • Size 210KB
  • Sample260720-m2rpvsfv9n
  • SHA256 1cc1fb0128cea6d803619e3b4bc507b71e7f5a1210c82246e7cf1bc4ff3f8d0e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
55cm .c,}=hp<yc<.0|}vs&&sheetrattrojan

Malware Config

Extracted

Family

  • sheetrat

Version

  • `Vyy8Ij-l!;}iK=3-rc(Xr&&

Campaign

  • 55CM .C,}=HP<YC<.0|}VS&&

Mutex

  • D0.}+"m";;uW5]s!l83i\8}OKXpDCVSm-DHIXme=`je&

Attributes
  • anti_virtual

    imU;5]BtCxxjxUP(b#uSDS&&

  • certificate

    3L'0pyiH3C',j+SN(Q'O@yS@|OB7tOIPf7`XO$ +8,y&

  • exclusion_wd

    y0$OrQeO8 Y.XQ|X,_;}ox&&

  • hidden_file

    I,pWo_OL#X]3wCtNM8KSYx&&

  • install

    +.@++3M8Q="tK,$wQUm=ex&&

  • install_watch_dog

    :_Mb;/!t_I(i;<ENe_WP]=&&

  • key

    ,C_tip;B:--'UU7xx'NyX=&&

  • path_client

    ]e. r',m.5I8l+Br0u!]l_]c/`@,bW"MI/_(\N]jDYb&

  • path_watch_dog

    }VXOUxpmS Bu_'-s<HY-@;$$#\\+D_j|!C0p'$ei"W,&

  • pump

    b}cpubw:Wp"/<:iPf3@HUS&&

  • rootkit

    D7eK8,o,.3tYXE_Yo #@<+r=PQBYf"(!Cpl@_.OfCs:&

  • task_client

    ryrQ5xH@8|`MI/SroS.K(=&&

  • task_watch_dog

    _:-Ms7WE!wLcYcE_YpQDyS&&

  • use_install_admin

    M'.8B=ru_#I8K}y3-'U]Or&&

  • user_init

    .Q'ws=`EDo.`|\o,+l|-u=&&

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Detects Sheetrat Payload 1 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ennl6nydr6tmzje.exe
    "C:\Users\Admin\AppData\Local\Temp\1ennl6nydr6tmzje.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2496

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/2496-0-0x000001FE8DD30000-0x000001FE8DD6A000-memory.dmp
        Download

        memory/2496-1-0x00007FFD60BFF000-0x00007FFD60C00000-memory.dmp
        Download

        memory/2496-2-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
        Download

        memory/2496-3-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
        Download

        memory/2496-4-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
        Download

        memory/2496-5-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
        Download