sheetrat | 6d8696a2fd1b6df9e3d3203bc2b2a76e5dce67ecf9ddac7baac7253b21ed2650

General

Target
Nursultan.exe
Size 357KB
Sample261020-t5p4rssvfx
SHA256 6d8696a2fd1b6df9e3d3203bc2b2a76e5dce67ecf9ddac7baac7253b21ed2650
MD5 a2749f531820ca5de15ea8b4e8da8150
SHA1 eb98e5c6a80f356166ae65e9197f9ce2c0c0a9fc
SHA512 97f360f790bc161d8d9dd2cd1c31595b5fbf1d6d533ea250f365f0b3fbabdad0809068329e04bef70daf53130b40304c630eabc0857a4b506d9f0bd772a9dda5
SSDEEP 6144:tKFPitiT8Dovy/v3UQvllqxr+4EAWKkb//A//CsP6:Ai0T8yyX5llqr6Kc
TLSH
T127748C067E44D3D1D8562BF783DF19100BB3ACE30AE2D60B7B19BEA1D5412626D2B76C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

1.8

C2

u973.cantdown.su:1728

Mutex

Attributes

anti_virtual
true
certificate
ncikt6gvnsjmg4x6qwd
exclusion_wd
true
hidden_file
true
install
true
install_watch_dog
true
key
m4wuo1y1jkuvvauouff752u59ylh9zi
path_client
%ApplicationData%\xdwd
path_watch_dog
%ProgramFiles%
pump
true
rootkit
rtl4nrivjo7lxet474d62v6ga
use_install_admin
true
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/1252-0-0x0000000000A00000-0x0000000000A5A000-memory.dmp	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\xdwd"	Nursultan.exe

Executes dropped EXE 7 IoCs

pid	Process
4688	xdwd
804	xdwd
2564	xdwd
1656	xdwd
4768	xdwd
4596	xdwd
1756	xdwd

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4364	cmd.exe
2508	cmd.exe
900	cmd.exe
3460	cmd.exe
4380	cmd.exe
3268	cmd.exe
4848	cmd.exe
2728	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwd
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwd
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Nursultan.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Nursultan.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwd
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwd
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwd
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwd
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwd
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwd
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwd
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwd
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwd
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwd
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwd
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwd

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2872	schtasks.exe
1148	schtasks.exe
1660	schtasks.exe
2336	schtasks.exe
4664	schtasks.exe
2716	schtasks.exe
4960	schtasks.exe
3020	schtasks.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1252	Nursultan.exe
Token: SeDebugPrivilege	4688	xdwd
Token: SeIncBasePriorityPrivilege	4688	xdwd
Token: SeDebugPrivilege	804	xdwd
Token: SeDebugPrivilege	2564	xdwd
Token: SeIncBasePriorityPrivilege	804	xdwd
Token: SeIncBasePriorityPrivilege	2564	xdwd
Token: SeDebugPrivilege	1656	xdwd
Token: SeDebugPrivilege	4768	xdwd
Token: SeDebugPrivilege	4596	xdwd
Token: SeDebugPrivilege	1756	xdwd
Token: SeIncBasePriorityPrivilege	1656	xdwd
Token: SeIncBasePriorityPrivilege	4768	xdwd
Token: SeIncBasePriorityPrivilege	4596	xdwd
Token: SeIncBasePriorityPrivilege	1756	xdwd

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 632	1252	Nursultan.exe	88
PID 1252 wrote to memory of 900	1252	Nursultan.exe	89
PID 900 wrote to memory of 2336	900	cmd.exe	92
PID 4688 wrote to memory of 3460	4688	xdwd	97
PID 3460 wrote to memory of 4664	3460	cmd.exe	99
PID 804 wrote to memory of 4380	804	xdwd	107
PID 4380 wrote to memory of 2716	4380	cmd.exe	109
PID 2564 wrote to memory of 3268	2564	xdwd	112
PID 3268 wrote to memory of 4960	3268	cmd.exe	114
PID 1656 wrote to memory of 4848	1656	xdwd	121
PID 4848 wrote to memory of 3020	4848	cmd.exe	123
PID 4768 wrote to memory of 2728	4768	xdwd	126
PID 2728 wrote to memory of 2872	2728	cmd.exe	129
PID 4596 wrote to memory of 4364	4596	xdwd	131
PID 4364 wrote to memory of 1148	4364	cmd.exe	133
PID 1756 wrote to memory of 2508	1756	xdwd	136
PID 2508 wrote to memory of 1660	2508	cmd.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
1⤵
- Modifies WinLogon for persistence
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="`^u~t_G4tuV7tk" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\xdwd" enable=yes & exit
  2⤵
  PID:632
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2336

C:\Users\Admin\AppData\Roaming\xdwd
C:\Users\Admin\AppData\Roaming\xdwd
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4664

C:\Users\Admin\AppData\Roaming\xdwd
C:\Users\Admin\AppData\Roaming\xdwd
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2716

C:\Users\Admin\AppData\Roaming\xdwd
C:\Users\Admin\AppData\Roaming\xdwd
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4960

C:\Users\Admin\AppData\Roaming\xdwd
C:\Users\Admin\AppData\Roaming\xdwd
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3020

C:\Users\Admin\AppData\Roaming\xdwd
C:\Users\Admin\AppData\Roaming\xdwd
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2872

C:\Users\Admin\AppData\Roaming\xdwd
C:\Users\Admin\AppData\Roaming\xdwd
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1148

C:\Users\Admin\AppData\Roaming\xdwd
C:\Users\Admin\AppData\Roaming\xdwd
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1660