Extracted

Extracted

Extracted

• • Target
    364d3883e81da01bb449083552e5f1526ec734bdf40b27e71a4670fc3df12e76.exe
  • Size 1.0MB
  • SHA256 364d3883e81da01bb449083552e5f1526ec734bdf40b27e71a4670fc3df12e76
  • MD5 65c3aa0a48027921f2f94df9fd45c422
  • SHA1 e2a6ffb0fe3813eeda24cef74fe77f9c24714a40
  • SHA512 0741579d063f725e5f99a2cdd5b3fb5377ee24fc88d17074a5c5cc0be770ad87a735997875bc3b0e417ddd897692a717bcd78c043e4bb72ab805d0d8cb9f4344
  • SSDEEP 12288:mceifO1cHqQA9UNEOIZBk1HIlnmMKr/kNiPDGd4GfjipfvzgiyBByiJv8TiMVlcL:ZCcKXZBZBk1HIlnm/a2G4y3v8GpQd
  • TLSH
    T19035019F251F8C52C4BD58B807BBB3C68B5C9D7A1661DC222C507E0A767C502B62BF2D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryevasionexecutionexploitsheetratxorium_stealerpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated V1.8 and higher

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version

  • Detects XoriumStealer payload

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Family: XoriumStealer

    XoriumStealer is an information stealer written in C#.

    stealerxorium_stealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Modifies Windows Firewall

    defense_evasion

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Stops running service(s)

    defense_evasionexecution

  • Windows security modification

    defense_evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2