Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 09:33
General
- Target Client.exe
- Size 101KB
- Sample260802-ljpbcazfme
- SHA256 31e4661556a9f8e103d704ba5f7056225984f934c0d2c7523bcf9c44297e9f46
Malware Config
Extracted
-
sheetrat
-
2.6
-
User
-
144.31.17.112:26472
-
Sheet_vgtxtugnkxhartfwu
-
ddr
IPMODE
-
hidden_file
true
-
install
false
-
install_watch_dog
true
-
path_client
%CommonPictures%\AMDHoiseSuppression.exe
-
path_watch_dog
%ApplicationData%\xdwdCamtasia Upgrade.exe
-
pump
true
-
rootkit
true
-
user_init
true
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4560-0-0x00000000009F0000-0x0000000000A10000-memory.dmp
memory/4560-1-0x00007FFF4B65F000-0x00007FFF4B660000-memory.dmp
memory/4560-2-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-3-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-4-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-5-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-6-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-7-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-8-0x000000001E260000-0x000000001E2D6000-memory.dmp
memory/4560-9-0x0000000002BE0000-0x0000000002BEC000-memory.dmp
memory/4560-10-0x000000001BD90000-0x000000001BDAE000-memory.dmp
memory/4560-11-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp