sheetrat | c27d346a1fb099b1cedd84556dc48825966fa5fedc1c9c56b6a125c6f3a91075

Resubmissions

11/08/2026, 04:33

260811-e6hnra1xdx10

11/08/2026, 04:29

260811-e4hkza1xcv10

Analysis

max time kernel
5s
max time network
8s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ygx97khbpkwsdwul.exe
Size 45KB
Sample260811-e4hkza1xcv
SHA256 c27d346a1fb099b1cedd84556dc48825966fa5fedc1c9c56b6a125c6f3a91075
MD5 a594d071cd3dce384d23e75105066036
SHA1 415d821eab8820458b6161eef037f6329075db1a
SHA512 a2b821844d94490d3911afc921e8b652298517e768ce4f71518ed61e159fbf14c2ec04857e14bf9fc32692e8e9227d22e24ae162ba3ac55f89c16b7ae72df5d8
SSDEEP 768:iK6oLTj3a21xEHUEgSd+fU5mkR2ObyCmwPg1ijX1oF911wZYBxkD:iKPzEHOc+fU5QOblxPggjX1oF9bwax8
TLSH
T168233A4433A88921E69F4AFE531BA38A5230C3735402DB4F7DDB5DE12582BD99B02EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

user execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

user

viovii-35455.portmap.host:35455

Mutex

Attributes

anti_virtual
false
certificate
lkkv5xs23fpzce
exclusion_wd
true
hidden_file
true
install
true
install_watch_dog
true
key
04twj1
path_client
%Cookies%\CookieManager.exe
path_watch_dog
%Windows%\cmd.exe
pump
false
rootkit
false
task_client
MicrosoftEdgeUpdateTaskMachineRU
task_watch_dog
MicrosoftEdgeUpdateTaskMachineEN
use_install_admin
true
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/1360-0-0x0000000000BA0000-0x0000000000BB0000-memory.dmp	family_sheetrat_v1
behavioral2/files/0x0006000000016d97-8.dat	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\CookieManager.exe"	ygx97khbpkwsdwul.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\cmd.exe	ygx97khbpkwsdwul.exe
File opened for modification	C:\Windows\cmd.exe	ygx97khbpkwsdwul.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4656	cmd.exe
1996	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3100	schtasks.exe
4812	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	ygx97khbpkwsdwul.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 5508	1360	ygx97khbpkwsdwul.exe	91
PID 1360 wrote to memory of 4656	1360	ygx97khbpkwsdwul.exe	92
PID 4656 wrote to memory of 3100	4656	cmd.exe	95
PID 1360 wrote to memory of 1996	1360	ygx97khbpkwsdwul.exe	96
PID 1996 wrote to memory of 4812	1996	cmd.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ygx97khbpkwsdwul.exe
"C:\Users\Admin\AppData\Local\Temp\ygx97khbpkwsdwul.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="i@zdeZ[rez6se4" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\CookieManager.exe" enable=yes & exit
  2⤵
  PID:5508
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachineRU" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\CookieManager.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachineRU" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\CookieManager.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3100
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "MicrosoftEdgeUpdateTaskMachineEN" /tr "C:\Windows\cmd.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "MicrosoftEdgeUpdateTaskMachineEN" /tr "C:\Windows\cmd.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4812
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\CookieManager.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\CookieManager.exe"
  2⤵
  PID:5332

C:\Windows\cmd.exe
C:\Windows\cmd.exe
1⤵
PID:2572

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\CookieManager.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\CookieManager.exe
1⤵
PID:5768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CookieManager.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\CookieManager.exe
Size 45KB
SHA256 c27d346a1fb099b1cedd84556dc48825966fa5fedc1c9c56b6a125c6f3a91075
MD5 a594d071cd3dce384d23e75105066036
SHA1 415d821eab8820458b6161eef037f6329075db1a
SHA512 a2b821844d94490d3911afc921e8b652298517e768ce4f71518ed61e159fbf14c2ec04857e14bf9fc32692e8e9227d22e24ae162ba3ac55f89c16b7ae72df5d8
SSDEEP 768:iK6oLTj3a21xEHUEgSd+fU5mkR2ObyCmwPg1ijX1oF911wZYBxkD:iKPzEHOc+fU5QOblxPggjX1oF9bwax8
TLSH
T168233A4433A88921E69F4AFE531BA38A5230C3735402DB4F7DDB5DE12582BD99B02EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1360-0-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

Download

memory/1360-1-0x00007FFBDD81F000-0x00007FFBDD820000-memory.dmp

Download

memory/1360-2-0x00007FFBDD690000-0x00007FFBDE034000-memory.dmp

Download

memory/1360-3-0x00007FFBDD690000-0x00007FFBDE034000-memory.dmp

Download

memory/1360-85-0x00007FFBDD690000-0x00007FFBDE034000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads