Resubmissions
05/09/2026, 08:13
260905-j4l1lshj7v1005/09/2026, 08:02
260905-jxhdvacg231005/09/2026, 07:56
260905-jstajscf831004/09/2026, 14:35
260904-rx8j2ataqc1004/09/2026, 14:22
260904-rpkg8sy1fv1004/09/2026, 11:25
260904-nje4sahl2z1004/09/2026, 09:29
260904-lgbmgaxapg1004/09/2026, 08:39
260904-kkemvsswet1004/09/2026, 08:24
260904-kayyrawbna1004/09/2026, 07:38
260904-jgvn8sej9w10Analysis
- user interaction
yes - max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 07:56
General
- Target test.exe
- Size 559KB
- Sample260905-jstajscf83
- SHA256 59083faee374f8c6e2358fdf3ad26fc5e8e9f927b333b7b16525a57ee62a2cec
Malware Config
Extracted
-
sheetrat
-
Sheet_kzmcescgwtjsuthvr
-
43.228.157.121:8848
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat obfuscated V1.8 and higher 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat obfuscated version 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x000000000000049C 0x00000000000004EC1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
xdwdCCleaner.exe
memory/3140-5-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp
memory/3140-121-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp
memory/3140-3-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp
memory/3140-4-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp
memory/3140-1-0x00000000003F0000-0x0000000000482000-memory.dmp
memory/3140-6-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp
memory/3140-7-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp
memory/3140-8-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp
memory/3140-9-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp
memory/3140-122-0x000000001BB20000-0x000000001BB96000-memory.dmp
memory/3140-2-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp
memory/3140-42-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp
memory/3140-0-0x00007FFB1289F000-0x00007FFB128A0000-memory.dmp
memory/3140-123-0x0000000002680000-0x000000000268C000-memory.dmp
memory/3140-139-0x000000001B840000-0x000000001B85E000-memory.dmp
memory/3140-1156-0x000000001BBC0000-0x000000001BBC8000-memory.dmp
memory/3140-337-0x0000000002690000-0x000000000269A000-memory.dmp
memory/3140-406-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp
memory/3140-505-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp
memory/3140-831-0x000000001C740000-0x000000001C74A000-memory.dmp
memory/4292-961-0x0000027661D10000-0x0000027661E59000-memory.dmp
memory/4292-207-0x0000027661D10000-0x0000027661E59000-memory.dmp