sheetrat | c209336b5f2488bcf4579b60322fe4dfeff3a6caec4de21ef77dac72f00bb791

General

Target
2026-09-29_ea6885c906ab2f05b781ff98d14ea5c6_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 998KB
Sample260930-sym56abf37
SHA256 c209336b5f2488bcf4579b60322fe4dfeff3a6caec4de21ef77dac72f00bb791
MD5 ea6885c906ab2f05b781ff98d14ea5c6
SHA1 a643cb021356b55c92bf451bc591ee4c40373f1a
SHA512 41ac675accfe4940528c2d09597dda7c67414ac1c336ff2888c8f435bfa974d490dcf26b9c7c62d0cefe1bf3f709cf5e0122946a382463d07590dde06e86c865
SSDEEP 12288:6p1W0JgkO45e7G5Yp7vRKnH8AGIa4mcZewDWNE30:O1tVc650FKcAGKmXwDWSk
TLSH
T120252A2A90546DA4CE4D12B79EFC555C116349120F22E30DBB78A3E3EF117E9BA9F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura discovery execution sheetrat packer persistence privilege_escalation trojan

Malware Config

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/files/0x0007000000024514-21.dat	family_sheetrat_v1
behavioral1/memory/1372-22-0x000001FFF5B70000-0x000001FFF5BB4000-memory.dmp	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\NtwkMonitor.exe"	GoogleUpdate.exe

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral1/memory/2572-86-0x0000024B33B00000-0x0000024B33B78000-memory.dmp	INDICATOR_EXE_Packed_Fody

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 5 IoCs

pid	Process
1372	GoogleUpdate.exe
2572	NtwkMonitor.exe
1184	WUDFHST.exe
628	NtwkMonitor.exe
2192	NtwkMonitor.exe

Loads dropped DLL 14 IoCs

pid	Process
2112	Process not Found
4780	Process not Found
1784	Process not Found
4632	Process not Found
2572	NtwkMonitor.exe
3356	Process not Found
60	Process not Found
1184	WUDFHST.exe
4956	Process not Found
540	Process not Found
3292	Process not Found
1008	Process not Found
628	NtwkMonitor.exe
2192	NtwkMonitor.exe

Looks up external IP address via web service 1 TTPs 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
66	api.ipify.org
87	api.ipify.org
23	api.ipify.org
24	api.ipify.org
27	api.ipify.org
28	api.ipify.org

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/memory/2572-86-0x0000024B33B00000-0x0000024B33B78000-memory.dmp	costura

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\NtwkMonitor.exe	NtwkMonitor.exe
File created	C:\Program Files\NtwkMonitor.exe	GoogleUpdate.exe
File opened for modification	C:\Program Files\NtwkMonitor.exe	GoogleUpdate.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xdwd.dll	GoogleUpdate.exe
File created	C:\Windows\WUDFHST.exe	GoogleUpdate.exe
File opened for modification	C:\Windows\WUDFHST.exe	GoogleUpdate.exe
File opened for modification	C:\Windows\WUDFHST.exe	NtwkMonitor.exe
File created	C:\Windows\xdwd.dll	GoogleUpdate.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1572	cmd.exe
2500	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GoogleUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NtwkMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WUDFHST.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WUDFHST.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NtwkMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NtwkMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NtwkMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GoogleUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NtwkMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NtwkMonitor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2492	schtasks.exe
1872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2572	NtwkMonitor.exe
2572	NtwkMonitor.exe
1184	WUDFHST.exe
1184	WUDFHST.exe
628	NtwkMonitor.exe
628	NtwkMonitor.exe
2192	NtwkMonitor.exe
2192	NtwkMonitor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	GoogleUpdate.exe
Token: SeDebugPrivilege	2572	NtwkMonitor.exe
Token: SeDebugPrivilege	1184	WUDFHST.exe
Token: SeIncBasePriorityPrivilege	2572	NtwkMonitor.exe
Token: SeDebugPrivilege	628	NtwkMonitor.exe
Token: SeDebugPrivilege	2192	NtwkMonitor.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1372	1904	2026-09-29_ea6885c906ab2f05b781ff98d14ea5c6_cobalt-strike_icedid_luca-stealer_njrat.exe	90
PID 1372 wrote to memory of 412	1372	GoogleUpdate.exe	96
PID 1372 wrote to memory of 1572	1372	GoogleUpdate.exe	99
PID 1572 wrote to memory of 2492	1572	cmd.exe	101
PID 1372 wrote to memory of 2500	1372	GoogleUpdate.exe	102
PID 2500 wrote to memory of 1872	2500	cmd.exe	104
PID 1372 wrote to memory of 2572	1372	GoogleUpdate.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-29_ea6885c906ab2f05b781ff98d14ea5c6_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ea6885c906ab2f05b781ff98d14ea5c6_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\C96830CF\GoogleUpdate.exe
  C:\Users\Admin\AppData\Local\C96830CF\GoogleUpdate.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" 471|HScLMPsCIja2Cz1DX9dhFJhYbFxUkvo4G0Y1dm2E2dwWBM0gERpMVmdLmEMc8kS3WindowsControl472|uKmL7l1ZrhqvxfIWHh610BP4Z0Ot9PvJwuPPY2CpVxg=C:\Program Files\NtwkMonitor.exe" enable=yes & exit
    3⤵
    PID:412
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "mprsvc" /tr "C:\Program Files\NtwkMonitor.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "mprsvc" /tr "C:\Program Files\NtwkMonitor.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2492
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "HealthCheck" /tr "C:\Windows\WUDFHST.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "HealthCheck" /tr "C:\Windows\WUDFHST.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1872
- - C:\Program Files\NtwkMonitor.exe
    "C:\Program Files\NtwkMonitor.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2572

C:\Windows\WUDFHST.exe
C:\Windows\WUDFHST.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184

C:\Program Files\NtwkMonitor.exe
"C:\Program Files\NtwkMonitor.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Program Files\NtwkMonitor.exe
"C:\Program Files\NtwkMonitor.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdate.exe

Path C:\Users\Admin\AppData\Local\C96830CF\GoogleUpdate.exe
Size 262KB
SHA256 8f026494ab99e1a13f2f36ae45598f55b6e2eb1a301d49e58ef7ddfae9822cd6
MD5 e4fee65332b1c03b7e62d51be0829b4e
SHA1 c59c645c4cd3e16ee06d11c4f031dbd0ad46ef4c
SHA512 2dc5d0fa3741ef8b6d17f99d4bd75fb013caa78124ce0b936ee6432a534d750e6582a9464c0ebfe20ac53d410e899bc9f1bdeb352d4ea2d099644944fb6a0a79
SSDEEP 6144:fAcLJvK3QDqfFRy34qi+9qLEupbQ4tdd8X6:fAEhK35Y3XqLEuO4tEK
TLSH
T12344AF383AE9C019F27B9F79CAD67643D63DE2736A02954A159202470F12BC1EDC397E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NtwkMonitor.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NtwkMonitor.exe.log
Size 1KB
SHA256 77507c05c8131f73d1dd1500992223819a6ab09cd820716e00bf907c9c7fc857
MD5 e3da8eae01f57153845d1533b6bed268
SHA1 a235712a631c52d2853e9136d9c4431358f34fd2
SHA512 b24b1064f8270981746f49a1b56a1aab21f7985af672bc6dcdbd67e498033714131ba4581c9c3d934e86b56d904bb0ecf322fae498133bbb9cb3a68ea6cad9d5
TLSH
T17711CE723371F1D889163F072C68268417BF4724BA90EE0CB5A8626ED9364275F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

loader.log

Path C:\Users\Admin\AppData\Local\Temp\loader.log
Size 535B
SHA256 be191ae7083d64a05076978dd17dede6fccaf8aa360e9e0cc03854da84e0dac7
MD5 a4a2e76f8a552b809dcd848bc6039999
SHA1 ffe1f767b0eebdf26e28683cd279d8e9be946da0
SHA512 2ffc19e513195a72839807a473619ca0b032ab090842aa28ea1fae28e803176a2e6b6fae2f2d5fa0a2f226ce627ec8d46cc6f6adb77f716768f63ac710819a22
TLSH
T128F02447E080D6E90670C9FB72A34ECAE9721718BC29763EDB8C815D7005A4F38B864A
MD5 SHA1 SHA512 TLSH

Submit Download

loader.log

Path C:\Users\Admin\AppData\Local\Temp\loader.log
Size 413B
SHA256 3fde980cdc43f54721f7934fed9ae9ed0a750a19618769ee6605228b9c7b0e40
MD5 d8f4974b0fc13c341b76afdefe11c909
SHA1 c5024cccc850460eabec743d06ab2b05ec9ed511
SHA512 a1f5739153217ee4e4e98888475bf68f7ec847d82a835611c198eb6f93e0f8b9cd45b69d4627b26e3e38af748a9ed655b7ddaa0a1d59c34bae03ea67ef3d47fe
TLSH
T1DEE02B42E480D3F50730CAAB57924EC9D5722718BD2C7A2DDB48805D7005F0F35E8646
MD5 SHA1 SHA512 TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1372-22-0x000001FFF5B70000-0x000001FFF5BB4000-memory.dmp

Download

memory/1372-23-0x000001FFF8120000-0x000001FFF8130000-memory.dmp

Download

memory/2572-86-0x0000024B33B00000-0x0000024B33B78000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads