sheetrat | 7233fb3e145071c14fcbb1f7a0103a8290b4ac1c3503758a63709c4b17924fdb

General

Target
2026-09-29_2275ee8a2e09633bffada35a6ea5d59d_cobalt-strike_icedid.exe
Size 457KB
Sample260930-e14n2aee93
SHA256 7233fb3e145071c14fcbb1f7a0103a8290b4ac1c3503758a63709c4b17924fdb
MD5 2275ee8a2e09633bffada35a6ea5d59d
SHA1 253009eb07c06244a1acb5cf839f988befeb1771
SHA512 6fb06379a000bf4761e3ce3016c5ea1a7e67f2662fdc6c4f5b86222516abaf9abd26e213562c0d2a164ca3f25dc8deb1abdcb21c98eacc3e8e02e3efc00b9e9f
SSDEEP 12288:qUoTjhOU7KWe//5MdF5H6lfWSHLPDAa0t1YdKdpbw1:qUoyaF2WSHLLAv1Yd6pbw1
TLSH
T1CAA4019B27B434FDE476827984668A09E772B8720761ABFF03A506850F176D04E3FE61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura discovery execution sheetrat packer persistence privilege_escalation trojan

Malware Config

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/files/0x0008000000024341-2.dat	family_sheetrat_v1
behavioral1/memory/3152-4-0x000001C00C630000-0x000001C00C674000-memory.dmp	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\NtwkMonitor.exe"	amwy13u.exe

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral1/memory/3768-67-0x0000019CF5B10000-0x0000019CF5B88000-memory.dmp	INDICATOR_EXE_Packed_Fody

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 5 IoCs

pid	Process
3152	amwy13u.exe
3768	NtwkMonitor.exe
4812	WUDFHST.exe
3236	NtwkMonitor.exe
2272	NtwkMonitor.exe

Loads dropped DLL 12 IoCs

pid	Process
3620	Process not Found
3772	Process not Found
4276	Process not Found
3868	Process not Found
3768	NtwkMonitor.exe
2852	Process not Found
4504	Process not Found
2596	Process not Found
4812	WUDFHST.exe
1668	Process not Found
3236	NtwkMonitor.exe
2272	NtwkMonitor.exe

Looks up external IP address via web service 1 TTPs 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
86	api.ipify.org
19	api.ipify.org
20	api.ipify.org
26	api.ipify.org
27	api.ipify.org
63	api.ipify.org
64	api.ipify.org

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/memory/3768-67-0x0000019CF5B10000-0x0000019CF5B88000-memory.dmp	costura

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\NtwkMonitor.exe	amwy13u.exe
File opened for modification	C:\Program Files\NtwkMonitor.exe	amwy13u.exe
File opened for modification	C:\Program Files\NtwkMonitor.exe	NtwkMonitor.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	amwy13u.exe
File opened for modification	C:\Windows\xdwd.dll	amwy13u.exe
File created	C:\Windows\WUDFHST.exe	amwy13u.exe
File opened for modification	C:\Windows\WUDFHST.exe	amwy13u.exe
File opened for modification	C:\Windows\WUDFHST.exe	NtwkMonitor.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1400	cmd.exe
3504	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	amwy13u.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NtwkMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WUDFHST.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NtwkMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	amwy13u.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NtwkMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WUDFHST.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NtwkMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NtwkMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NtwkMonitor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3416	schtasks.exe
3204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3768	NtwkMonitor.exe
3768	NtwkMonitor.exe
4812	WUDFHST.exe
4812	WUDFHST.exe
3236	NtwkMonitor.exe
3236	NtwkMonitor.exe
2272	NtwkMonitor.exe
2272	NtwkMonitor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3152	amwy13u.exe
Token: SeDebugPrivilege	3768	NtwkMonitor.exe
Token: SeDebugPrivilege	4812	WUDFHST.exe
Token: SeIncBasePriorityPrivilege	3768	NtwkMonitor.exe
Token: SeDebugPrivilege	3236	NtwkMonitor.exe
Token: SeDebugPrivilege	2272	NtwkMonitor.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3152	2648	2026-09-29_2275ee8a2e09633bffada35a6ea5d59d_cobalt-strike_icedid.exe	93
PID 3152 wrote to memory of 2544	3152	amwy13u.exe	98
PID 3152 wrote to memory of 1400	3152	amwy13u.exe	100
PID 1400 wrote to memory of 3416	1400	cmd.exe	102
PID 3152 wrote to memory of 3504	3152	amwy13u.exe	104
PID 3504 wrote to memory of 3204	3504	cmd.exe	106
PID 3152 wrote to memory of 3768	3152	amwy13u.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-29_2275ee8a2e09633bffada35a6ea5d59d_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_2275ee8a2e09633bffada35a6ea5d59d_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\AppDev\amwy13u.exe
  "C:\Users\Admin\AppData\Local\AppDev\amwy13u.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" 471|HScLMPsCIja2Cz1DX9dhFJhYbFxUkvo4G0Y1dm2E2dwWBM0gERpMVmdLmEMc8kS3WindowsControl472|uKmL7l1ZrhqvxfIWHh610BP4Z0Ot9PvJwuPPY2CpVxg=C:\Program Files\NtwkMonitor.exe" enable=yes & exit
    3⤵
    PID:2544
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "mprsvc" /tr "C:\Program Files\NtwkMonitor.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "mprsvc" /tr "C:\Program Files\NtwkMonitor.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3416
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "HealthCheck" /tr "C:\Windows\WUDFHST.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "HealthCheck" /tr "C:\Windows\WUDFHST.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3204
- - C:\Program Files\NtwkMonitor.exe
    "C:\Program Files\NtwkMonitor.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3768

C:\Windows\WUDFHST.exe
C:\Windows\WUDFHST.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Program Files\NtwkMonitor.exe
"C:\Program Files\NtwkMonitor.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Program Files\NtwkMonitor.exe
"C:\Program Files\NtwkMonitor.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amwy13u.exe

Path C:\Users\Admin\AppData\Local\AppDev\amwy13u.exe
Size 262KB
SHA256 8f026494ab99e1a13f2f36ae45598f55b6e2eb1a301d49e58ef7ddfae9822cd6
MD5 e4fee65332b1c03b7e62d51be0829b4e
SHA1 c59c645c4cd3e16ee06d11c4f031dbd0ad46ef4c
SHA512 2dc5d0fa3741ef8b6d17f99d4bd75fb013caa78124ce0b936ee6432a534d750e6582a9464c0ebfe20ac53d410e899bc9f1bdeb352d4ea2d099644944fb6a0a79
SSDEEP 6144:fAcLJvK3QDqfFRy34qi+9qLEupbQ4tdd8X6:fAEhK35Y3XqLEuO4tEK
TLSH
T12344AF383AE9C019F27B9F79CAD67643D63DE2736A02954A159202470F12BC1EDC397E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NtwkMonitor.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NtwkMonitor.exe.log
Size 1KB
SHA256 77507c05c8131f73d1dd1500992223819a6ab09cd820716e00bf907c9c7fc857
MD5 e3da8eae01f57153845d1533b6bed268
SHA1 a235712a631c52d2853e9136d9c4431358f34fd2
SHA512 b24b1064f8270981746f49a1b56a1aab21f7985af672bc6dcdbd67e498033714131ba4581c9c3d934e86b56d904bb0ecf322fae498133bbb9cb3a68ea6cad9d5
TLSH
T17711CE723371F1D889163F072C68268417BF4724BA90EE0CB5A8626ED9364275F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3152-4-0x000001C00C630000-0x000001C00C674000-memory.dmp

Download

memory/3152-5-0x000001C0283E0000-0x000001C0283F0000-memory.dmp

Download

memory/3768-67-0x0000019CF5B10000-0x0000019CF5B88000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads