Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/09/2026, 19:34
Behavioral task
behavioral1
Sample
Cl1ient.exe
Resource
win11-20260911-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target Cl1ient.exe
- Size 538KB
- Sample260930-yahtesserf
- SHA256 4449878fc8fbc45a1cc696aa041fc73d7006340cb6f8a85bb49144bff8c9dfa3
- MD5 6601f9f2331fdfd726e483b46c15f9be
- SHA1 2cf6d2a6ce8f78658bd1dd8afb63dadcba543ac8
- SHA512 5e645d43321870141b2dffc6e427d0ba067ed314d42203f57e9566e207f452bc4821a49d92ad2a44686c6ac3cab317e38c67941a75661dea19ff6fafb705e6e2
- SSDEEP 6144:1+zR8m9jmdzZzpVwEdYE7OCOZ9+ZvYrVwdWTOpk2PM0iGHAajfbA3ZzPsz6z3NOl:1oRf9avcSpO2NeVY/29GA/Vs+dn
- TLSH T10AC4910CFE81E805DE1E3DB7CFE915004B7164C1AE1196462119AFFE8B663B35AE267C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sheetrat
Version
-
2.6
Campaign
-
Sheet_okdjwdikbfdjj
Signatures
- Detects Sheetrat obfuscated V1.8 and higher 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule behavioral1/memory/5176-0-0x0000000000D80000-0x0000000000E0C000-memory.dmp family_sheetrat_v4 - Detects Sheetrat obfuscated version 1 IoCs
resource yara_rule behavioral1/memory/5176-0-0x0000000000D80000-0x0000000000E0C000-memory.dmp Sheetrat_v5 - Modifies security service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\mDns svchost.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Parameters svchost.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Parameters\PortKeywords svchost.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Parameters\PortKeywords\mDns svchost.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Cl1ient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Cl1ient.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5176 Cl1ient.exe Token: SeDebugPrivilege 5444 taskmgr.exe Token: SeSystemProfilePrivilege 5444 taskmgr.exe Token: SeCreateGlobalPrivilege 5444 taskmgr.exe - Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe - Suspicious use of SendNotifyMessage 51 IoCs
pid Process 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe 5444 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cl1ient.exe"C:\Users\Admin\AppData\Local\Temp\Cl1ient.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5176
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
- Modifies security service
PID:4252