sheetrat | 59083faee374f8c6e2358fdf3ad26fc5e8e9f927b333b7b16525a57ee62a2cec

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/09/2026, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.exe
Size 559KB
Sample260904-rpkg8sy1fv
SHA256 59083faee374f8c6e2358fdf3ad26fc5e8e9f927b333b7b16525a57ee62a2cec
MD5 351f4b952189219295d0ba391905f67c
SHA1 45dcccd2b8b4bd5a66be359e93d274d22f1393e7
SHA512 d626914339ad2925ccf92124725c829397cb3ad38bf8d6bc121cb45f6c83ee03d5dc19626947de14eebb13dcde986702ff8c44f0c233b64497e832ff93cc04d3
SSDEEP 6144:CpXWl7C+5e9HlLftj4kLlIFjKEM39/tB3GKVGcxwOY6UuuIYik9Jb2xe4/XZTsAw:CWGftb+8EeVnGck6tuSkOeMpTXvY
TLSH
T1D5C4921CFE91E805CD1A3E73CFE914049B7121C1AE219642315AAFFD8B663B658E727C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_kzmcescgwtjsuthvr discovery sheetrat trojan

Malware Config

Extracted

Family

sheetrat

Campaign

Sheet_kzmcescgwtjsuthvr

43.228.157.121:8848

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/3156-0-0x0000000000F90000-0x0000000001022000-memory.dmp	family_sheetrat_v4
behavioral2/files/0x000d00000001c548-9.dat	family_sheetrat_v4

Detects Sheetrat obfuscated version 2 IoCs

resource	yara_rule
behavioral2/memory/3156-0-0x0000000000F90000-0x0000000001022000-memory.dmp	Sheetrat_v5
behavioral2/files/0x000d00000001c548-9.dat	Sheetrat_v5

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
5	icanhazip.com
5	api.ipify.org
5	checkip.amazonaws.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xdwdCCleaner.exe	test.exe
File created	C:\Windows\xdwdCCleaner.exe	test.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe
3156	test.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	test.exe

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwdCCleaner.exe

Path C:\Windows\xdwdCCleaner.exe
Size 559KB
SHA256 59083faee374f8c6e2358fdf3ad26fc5e8e9f927b333b7b16525a57ee62a2cec
MD5 351f4b952189219295d0ba391905f67c
SHA1 45dcccd2b8b4bd5a66be359e93d274d22f1393e7
SHA512 d626914339ad2925ccf92124725c829397cb3ad38bf8d6bc121cb45f6c83ee03d5dc19626947de14eebb13dcde986702ff8c44f0c233b64497e832ff93cc04d3
SSDEEP 6144:CpXWl7C+5e9HlLftj4kLlIFjKEM39/tB3GKVGcxwOY6UuuIYik9Jb2xe4/XZTsAw:CWGftb+8EeVnGck6tuSkOeMpTXvY
TLSH
T1D5C4921CFE91E805CD1A3E73CFE914049B7121C1AE219642315AAFFD8B663B658E727C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3156-0-0x0000000000F90000-0x0000000001022000-memory.dmp

Download

memory/3156-1-0x00007FF86468F000-0x00007FF864690000-memory.dmp

Download

memory/3156-2-0x00007FF864500000-0x00007FF864EA4000-memory.dmp

Download

memory/3156-3-0x00007FF864500000-0x00007FF864EA4000-memory.dmp

Download

memory/3156-4-0x00007FF864500000-0x00007FF864EA4000-memory.dmp

Download

memory/3156-37-0x00007FF864500000-0x00007FF864EA4000-memory.dmp

Download

memory/3156-118-0x00007FF864500000-0x00007FF864EA4000-memory.dmp

Download

memory/3156-1069-0x000000001C5C0000-0x000000001C636000-memory.dmp

Download

memory/3156-1071-0x0000000001740000-0x000000000174C000-memory.dmp

Download

memory/3156-1080-0x0000000001770000-0x000000000178E000-memory.dmp

Download