sheetrat | d3f4169604a1c88e1a588311c858f06c0e7cc395ebd523f724b2a4d214308d17

Analysis

max time kernel
298s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Новый текстовый документ.ps1
Size 69KB
Sample260808-jctalscd36
SHA256 d3f4169604a1c88e1a588311c858f06c0e7cc395ebd523f724b2a4d214308d17
MD5 ab04d3ded9adddacd1e79dc6524c02c8
SHA1 7522acb9a520e4a8ce4adfecec93597dac8f9641
SHA512 036ddfcfc98b097e2d11c6bf66d44633d27889242977a48f3c8cc4838099d9f02b630cb2f59406f5921dc3a8a3dc7a7b7567e7b697e293fd1595251e7f3394b7
SSDEEP 1536:D/Adc6uqut+7V5rLAqTWIG9FKQLFtzhrK3mKWx4KfRadgAhwQ:4hfZNTW9FKQzzdKWZIwQ
TLSH
T10963F2274B9984A00633799B7487A8039E49DCE980D9C394674DCEB1FD87D59E2BC373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

gay12311 defense_evasion discovery execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

gay12311

91.92.47.228:1313

Mutex

Attributes

anti_virtual
false
certificate
qaqckq
exclusion_wd
true
hidden_file
true
install
true
install_watch_dog
true
key
fp3wwm90tcqqmz60z1c5joqw7atlap
path_client
%Cookies%\WindowsHeath.exe
path_watch_dog
%Templates%\svchost.exe
pump
false
rootkit
false
task_client
svchost.exe
use_install_admin
true
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x001000000001c4f0-21.dat	family_sheetrat_v1
behavioral2/memory/4120-25-0x000001ED351D0000-0x000001ED351E2000-memory.dmp	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\WindowsHeath.exe"	tmp4731.tmp.exe

Executes dropped EXE 3 IoCs

pid	Process
4120	tmp4731.tmp.exe
5720	WindowsHeath.exe
860	WindowsHeath.exe

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	icanhazip.com
7	api.ipify.org
9	api.ipify.org
14	icanhazip.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\NULCD	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6096	PowerShell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5916	cmd.exe
5496	cmd.exe
948	cmd.exe
4964	CMD.exe
3804	cmd.exe
5796	cmd.exe
4300	cmd.exe
5032	cmd.exe
3936	cmd.exe
3624	cmd.exe
5464	cmd.exe
3544	cmd.exe
1440	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5300	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4544	schtasks.exe
3828	schtasks.exe
2840	schtasks.exe
3340	schtasks.exe
5096	schtasks.exe
4876	schtasks.exe
4860	schtasks.exe
4348	schtasks.exe
824	schtasks.exe
1416	schtasks.exe
2956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
6096	PowerShell.exe
6096	PowerShell.exe
6096	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	6096	PowerShell.exe
Token: SeDebugPrivilege	4120	tmp4731.tmp.exe
Token: SeDebugPrivilege	5720	WindowsHeath.exe
Token: SeDebugPrivilege	860	WindowsHeath.exe
Token: SeIncBasePriorityPrivilege	860	WindowsHeath.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 6096 wrote to memory of 4120	6096	PowerShell.exe	91
PID 4120 wrote to memory of 5108	4120	tmp4731.tmp.exe	93
PID 4120 wrote to memory of 3804	4120	tmp4731.tmp.exe	94
PID 3804 wrote to memory of 4544	3804	cmd.exe	97
PID 4120 wrote to memory of 3624	4120	tmp4731.tmp.exe	98
PID 3624 wrote to memory of 4860	3624	cmd.exe	100
PID 4120 wrote to memory of 5720	4120	tmp4731.tmp.exe	101
PID 860 wrote to memory of 5464	860	WindowsHeath.exe	104
PID 5464 wrote to memory of 4348	5464	cmd.exe	106
PID 5720 wrote to memory of 5796	5720	WindowsHeath.exe	107
PID 5796 wrote to memory of 3828	5796	cmd.exe	109
PID 860 wrote to memory of 4300	860	WindowsHeath.exe	110
PID 4300 wrote to memory of 2840	4300	cmd.exe	112
PID 860 wrote to memory of 3544	860	WindowsHeath.exe	113
PID 3544 wrote to memory of 3340	3544	cmd.exe	115
PID 860 wrote to memory of 1440	860	WindowsHeath.exe	117
PID 1440 wrote to memory of 824	1440	cmd.exe	119
PID 860 wrote to memory of 5032	860	WindowsHeath.exe	120
PID 5032 wrote to memory of 1416	5032	cmd.exe	122
PID 860 wrote to memory of 5916	860	WindowsHeath.exe	123
PID 5916 wrote to memory of 2956	5916	cmd.exe	125
PID 860 wrote to memory of 5496	860	WindowsHeath.exe	126
PID 5496 wrote to memory of 5096	5496	cmd.exe	128
PID 860 wrote to memory of 948	860	WindowsHeath.exe	129
PID 948 wrote to memory of 4876	948	cmd.exe	131
PID 860 wrote to memory of 4964	860	WindowsHeath.exe	132
PID 4964 wrote to memory of 1412	4964	CMD.exe	134
PID 860 wrote to memory of 3936	860	WindowsHeath.exe	135
PID 3936 wrote to memory of 5300	3936	cmd.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Новый текстовый документ.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6096
- C:\Users\Admin\AppData\Local\Temp\tmp4731.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4731.tmp.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="nP*d1Eg+1*DU1L" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" enable=yes & exit
    3⤵
    PID:5108
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4544
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3624
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4860
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5720
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5796
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3828

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4348
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2840
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3340
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:824
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1416
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2956
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5096
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4876
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /deleTe /F /Tn "svchost.exe" & exit& exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\schtasks.exe
    schtasks /deleTe /F /Tn "svchost.exe"
    3⤵
    PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1DF9.tmp.bat""
  2⤵
  - Drops file in Windows directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\system32\timeout.exe
    timeout 10 "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies"DEL "WindowsHeath.exe" /f /qCD "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates"DEL "svchost.exe" /f /qCD "C:\Users\Admin\AppData\Local\Temp"DEL "tmp1DF9.tmp.bat" /f /q
    3⤵
    - Delays execution with timeout.exe
    PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp1DF9.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp1DF9.tmp.bat
Size 258B
SHA256 3f93a8e7ae843008d85ead3fc4809f955f3ba9d1dfb5d32fcb993ac2b1be7713
MD5 776a3b75d9863eebef95b4c02ff99ccf
SHA1 77dedc34787562291d894a9db5b90b030f396ff3
SHA512 3ae8e2f616ae9c97387e7f6d7cceab5c604a54e06a6f010603591f2184eb3d95d8ecadc942e1a13ea7d6d39f2c68431c5f1a2494c382d262e77d172dbac6fc19
TLSH
T1D6D02B01E0A9CB0B68366013417B429940278507FB85AF5003488528344084CE89B3C5
MD5 SHA1 SHA512 TLSH

Submit Download

tmp4731.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4731.tmp.exe
Size 49KB
SHA256 e422e87dec7e33ad1ef75f634ca08eed9d91cf5b919e9b42d85570d6f80d83a4
MD5 2564dbb275397da9da6cecb7862c0aba
SHA1 0610cc534698139042a3b3a172df3bca47c79dde
SHA512 3a811659cc92dd80abf95aa65cf8536101ab0ac7b23fdc3dcbd9367e64766bdd4a419d38125dd5d2a683af0eb63d2f83445e7403028211837554a8c075e3f8cf
SSDEEP 768:vFEV2K0s8EXYdX/0aWOfgd7DpXO8wiYnhf6HObdiQwbk0AttjHvZb3581lAY:tEV2K0cXYdX/6OLSObULbGarV
TLSH
T1C7334A4873C5CEA1D5BE22B99B63B300DB34D1435902E70F2ECB91C56EAB3D8894ADD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4120-110-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/4120-29-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/4120-28-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/4120-27-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/4120-26-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/4120-25-0x000001ED351D0000-0x000001ED351E2000-memory.dmp

Download

memory/6096-8-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-0-0x00007FFEBC63F000-0x00007FFEBC640000-memory.dmp

Download

memory/6096-12-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-13-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-14-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-15-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-17-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-10-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-9-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-11-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-7-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-6-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-5-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-4-0x000001C767D10000-0x000001C767D32000-memory.dmp

Download

memory/6096-112-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-113-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-117-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download

memory/6096-1-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp

Download