sheetrat | fc9def1775cdb1f8504c65ea15f19c898126d87639cb8e21d189e52708284393

Resubmissions

18/08/2026, 22:39

260818-2lb2sstvdw10

18/08/2026, 22:33

260818-2gmmqsal3y10

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
krivopykasd-main/dotacheat.exe
Size 36KB
Sample260818-2lb2sstvdw
SHA256 fc9def1775cdb1f8504c65ea15f19c898126d87639cb8e21d189e52708284393
MD5 f865f878ca382d4d2895a35ca25f0e30
SHA1 72f572b296e7b044234802da9ece2cc63f3da375
SHA512 c8c181f78f9fe25570d6dcd9f7be5e91ec39b5df69570d683e3884d8e5cbcdc01d4408dccf6de0dbbb644cf25e48dc5f19e1fcaa0ffed36f634c06b463a883dc
SSDEEP 768:0p1bDBNXzU2ABbsVEwqLlwnp9ODanZqJFO+ci1hT:25fA2ABbQvqLlwnp9OYwL
TLSH
T170F2D02153A402B2CFAD5BBA687372438377D115EEAB977F0CDD50ABDE6325807422B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

123 defense_evasion discovery execution sheetrat xbinder loader persistence trojan

Malware Config

Extracted

Family

xbinder

Mutex

TVnD8qdo5WCuHo2bU

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
ds.py
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
proxyds.exe

Extracted

Family

sheetrat

Version

Campaign

m49d9hp2.torgports.shop:22961

Mutex

Attributes

anti_virtual
false
certificate
m5f51rft0
exclusion_wd
false
hidden_file
false
install
true
install_watch_dog
false
key
uzb1fscal13zmtzsc2y49unwu0ej
path_client
%ApplicationData%\System32\expIorer
pump
false
rootkit
false
task_client
Microsoft\Windows\WAppCrashNvTew
use_install_admin
true
user_init
false

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat
Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x000e00000001c580-13.dat	family_sheetrat_v1
behavioral2/memory/1304-17-0x000002139E140000-0x000002139E152000-memory.dmp	family_sheetrat_v1

Executes dropped EXE 2 IoCs

pid	Process
1304	proxyds.exe
4856	expIorer

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org
4	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\NULCD	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3408	cmd.exe
5564	CMD.exe
2180	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5808	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	dotacheat.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	OpenWith.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5888	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	proxyds.exe
Token: SeDebugPrivilege	4856	expIorer
Token: SeIncBasePriorityPrivilege	4856	expIorer

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3100	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1304	1168	dotacheat.exe	90
PID 1304 wrote to memory of 5532	1304	proxyds.exe	92
PID 1304 wrote to memory of 3408	1304	proxyds.exe	93
PID 3408 wrote to memory of 5888	3408	cmd.exe	96
PID 4856 wrote to memory of 5564	4856	expIorer	101
PID 4856 wrote to memory of 2180	4856	expIorer	102
PID 5564 wrote to memory of 1064	5564	CMD.exe	105
PID 2180 wrote to memory of 5808	2180	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\krivopykasd-main\dotacheat.exe
"C:\Users\Admin\AppData\Local\Temp\krivopykasd-main\dotacheat.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Users\Admin\AppData\Local\Temp\proxyds.exe
  "C:\Users\Admin\AppData\Local\Temp\proxyds.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="El,mfS"~f,HVf_" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\System32\expIorer" enable=yes & exit
    3⤵
    PID:5532
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Admin\AppData\Roaming\System32\expIorer" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Admin\AppData\Roaming\System32\expIorer" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4184

C:\Users\Admin\AppData\Roaming\System32\expIorer
"C:\Users\Admin\AppData\Roaming\System32\expIorer"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\system32\CMD.exe
  "CMD" /c schtasks /deleTe /F /Tn "Microsoft\Windows\WAppCrashNvTew" & exit& exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5564
- - C:\Windows\System32\schtasks.exe
    schtasks /deleTe /F /Tn "Microsoft\Windows\WAppCrashNvTew"
    3⤵
    PID:1064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE31E.tmp.bat""
  2⤵
  - Drops file in System32 directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\System32\timeout.exe
    timeout 10 "C:\Users\Admin\AppData\Roaming\System32"DEL "expIorer" /f /qCD "C:\Users\Admin\AppData\Local\Temp"DEL "tmpE31E.tmp.bat" /f /q
    3⤵
    - Delays execution with timeout.exe
    PID:5808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ds.py

Path C:\Users\Admin\AppData\Local\Temp\ds.py
Size 6KB
SHA256 0d01a071a644e17ade596def262e8aa4ce16e7798395efb6df96b54987c8d87c
MD5 3468dcac09818375b554d4fe422663a1
SHA1 97855891ae193883d8c06d1822f21ede75857613
SHA512 88de804e8948403ac314d62ebc046e96169f7c7a221f2e3b6494ca66fcc55c1b73d892acd56a9ab637e42529defa9ac64e5c85a6a1a58f11f693355f709ce048
SSDEEP 192:5pAFzmd4/wAwxaCZ/wct1x/CaCv/JVEWkxKtnk48Mv8u:5pMzK8Cl1VC7sLMv8u
TLSH
T1FBD19546AC5C548E42309029DD26E029FE9E66BB7B272B12B97C507C3FF8530C23439D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

proxyds.exe

Path C:\Users\Admin\AppData\Local\Temp\proxyds.exe
Size 48KB
SHA256 25a60f45737aeccbac6c0eeb7084a477faf10090637fd268f07ef137fd1c3135
MD5 9cb101b71d3cf8d7b2694a2d0da1e027
SHA1 346435458a59806e7a18511d74e04f289b9fd470
SHA512 03e08e2d37aa62a3b4e080e798f16ced3acc51a3f66af33068906fdcb62b4b21995fbf76b46757b50f44b2cd45d5dd7e73d34753c2450cf1bf7797ad53da35fa
SSDEEP 768:89o8xx4dlIEnvqHkZYdoBvv1nt9/nhXHObdPRwFnDK0U8u1yi6:B8rEnvqHkm4X1tBNOb1qM0U86yh
TLSH
T1D1234A0877DDC960D9EF95B9CA13B210A7349247A503DF4F1DC790F66A033DAA84ACE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpE31E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpE31E.tmp.bat
Size 145B
SHA256 86a1bcbba1b168312dd0b056a07ea665765fe5e24fdbb4f854c2b35518cf921a
MD5 508639c621cf49042e9698c917ae8821
SHA1 5bd7057b44cfd64dcbf39d8da68ee62f0c3b21e4
SHA512 2b2b089059a129d2702a87d4f596d3e24ed67412c966cdfc752647dcca2342e4131f23547b879cb5a93ca0e5d04c1188aa966493d336fcaee1ac072d7265db10
TLSH
T1E7C02B0172C7CF0D384700031B7944EC40774848FFC82B04979C840C2080828F16734D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1168-1-0x00000000009F0000-0x0000000000A00000-memory.dmp

Download

memory/1168-0-0x00007FFF027AF000-0x00007FFF027B0000-memory.dmp

Download

memory/1168-2-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/1168-4-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/1168-18-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/1304-17-0x000002139E140000-0x000002139E152000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads