sheetrat | dropped_malware_RuntimeBroker[.]exe

General

Target
dropped_malware_RuntimeBroker.exe
Size 199KB
Sample260831-l2ngrsssbv
SHA256 867057b5fbbc5cabcef4dccc17be30108ca9513055985aa7c8bc56544be5ad3d
MD5 3c0888686421d1540abca47b97f32729
SHA1 d90d7a28c27f78a9f49673e7a52f7039050f3680
SHA512 e441db58b8639e21a5cb98c5aee2cd45b93b259180645671b908aeebb1260259ba3d48eefd62340e9e024bcb65b846e472d89d3452dca994d29fa876644dd644
SSDEEP 3072:aJTfLY1s4QdZKNeN3w/jhlhE1Z8Nig99FVRodG31Zbe4bsbf4lDPO/Qny7cUd2Y:Kss4Qdse6VlWT8b93V6M1Ne4IbGad9
TLSH
T1EA145C2EAFE14546F1ED0ABC89423452C73DF6DBA403F346A786A17B0DC6368ED450DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_mejmovssqulxp trojan sheetrat

Malware Config

Extracted

Family

sheetrat

Version

2.5

Campaign

Sheet_mejmovssqulxp

C2

https://pastefy.app/2aUAC7Vy/raw

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
dropped_malware_RuntimeBroker.exe

File Explorer

dropped_malware_RuntimeBroker.exe

.exe 199KB

dropped_malware_RuntimeBroker.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 867057b5fbbc5cabcef4dccc17be30108ca9513055985aa7c8bc56544be5ad3d
MD5 3c0888686421d1540abca47b97f32729
SHA1 d90d7a28c27f78a9f49673e7a52f7039050f3680
SHA512 e441db58b8639e21a5cb98c5aee2cd45b93b259180645671b908aeebb1260259ba3d48eefd62340e9e024bcb65b846e472d89d3452dca994d29fa876644dd644
SSDEEP 3072:aJTfLY1s4QdZKNeN3w/jhlhE1Z8Nig99FVRodG31Zbe4bsbf4lDPO/Qny7cUd2Y:Kss4Qdse6VlWT8b93V6M1Ne4IbGad9
TLSH
T1EA145C2EAFE14546F1ED0ABC89423452C73DF6DBA403F346A786A17B0DC6368ED450DA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6b:e5:aa:a5:3d:52:92:7f:b7:e4:71:7b:80:b6:05:4b:0a:e5:74:31:bc:bd:32:6f:8d:98:db:ef:34:04:3f:4e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 13, 2024

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:70:69:f2:ac:06:49:04:ec:1c:00:00:00:00:04:70

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2024 - Feb 7, 2025

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:e8:50:b0:80:cf:2b:72:99:4d:00:01:00:00:01:e8

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

198958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dropped_malware_RuntimeBroker.exe

PE Signature issue

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

dropped_malware_RuntimeBroker.exe

PE Signature issue

mscoree

dotnet