Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 10:32
General
- Target xesis.exe
- Size 48KB
- Sample260729-mk6sfsfg34
- SHA256 f83eaaa6484f776a75642b19f80e7327ba2279ab850331fb0721d228782af99d
Malware Config
Extracted
-
sheetrat
-
1.8
-
sex
-
tcp.niceports.shop:23223
-
anti_virtual
false
-
certificate
ez9wm4o0gqigdfnp
-
install
false
-
key
x0otn4xn0p5pu1ej6j
-
path_watch_dog
j1@pw3u3f3rc(k0f3pw10%
-
pump
5)ew)fyp9
-
rootkit
p:..N\dNp
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xesis.exe"C:\Users\Admin\AppData\Local\Temp\xesis.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4360-0-0x00007FF9BD71F000-0x00007FF9BD720000-memory.dmp
memory/4360-1-0x00000000008D0000-0x00000000008E2000-memory.dmp
memory/4360-2-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4360-3-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4360-4-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4360-5-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4360-6-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4360-8-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4360-7-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4360-9-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4360-10-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/4360-11-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp