Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
17/08/2026, 12:28
General
- Target gg11.exe
- Size 106KB
- Sample260817-pnsfcabl2w
- SHA256 a0cf8ed3b3202790d34c94ee9a9c36529a0aceda88d840fbdcf0657a1003caab
Score
10/10
Malware Config
Extracted
Family
-
sheetrat
Campaign
-
Default
C2
-
minecraftserv65-52377.portmap.host:52377
Mutex
-
Sheet_blafanjbqvi
Attributes
-
ddr
IPMODE
-
hidden_file
true
-
install
false
-
install_watch_dog
true
-
path_client
%Cookies%\xdwdMicrosoft SQL Server Management Studio.exe
-
path_watch_dog
%MyDocuments%\xdwdMicrosoft Outlook.exe
-
pump
true
-
rootkit
true
-
user_init
true
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\gg11.exe"C:\Users\Admin\AppData\Local\Temp\gg11.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3476-0-0x0000000000A00000-0x0000000000A20000-memory.dmp
memory/3476-1-0x000000001C500000-0x000000001C510000-memory.dmp
memory/3476-2-0x000000001C500000-0x000000001C510000-memory.dmp
memory/3476-3-0x0000000002C30000-0x0000000002C3C000-memory.dmp
memory/3476-5-0x000000001C920000-0x000000001CA54000-memory.dmp