Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
23/10/2026, 10:59
General
- Target olf1d1kqjx6nkhnz.exe
- Size 181KB
- Sample261023-m3c8vsbs21
- SHA256 cc25b8243b1d5dcdd86d74950063ffc3de60516c56585af2414d7bee3efb6936
Malware Config
Extracted
-
sheetrat
-
1.8
-
openport.pw:40131
-
anti_virtual
false
-
certificate
cfxobj705xusxlh
-
exclusion_wd
false
-
hidden_file
true
-
install
true
-
install_watch_dog
true
-
key
kvkgxv65dh1k
-
path_client
%LocalApplicationData%\xdwdxd.exe
-
path_watch_dog
%LocalApplicationData%\xdwdbot.exe
-
pump
false
-
rootkit
jozymk4w6rtdpu
-
task_client
svchost
-
task_watch_dog
svchost
-
use_install_admin
false
-
user_init
true
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 14 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Start PowerShell.
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\olf1d1kqjx6nkhnz.exe"C:\Users\Admin\AppData\Local\Temp\olf1d1kqjx6nkhnz.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="-:9p&~=\&9ol&+" dir=in action=allow program="C:\Users\Admin\AppData\Local\xdwdxd.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\xdwdxd.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\xdwdxd.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\xdwdbot.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\xdwdbot.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\xdwdxd.exe"C:\Users\Admin\AppData\Local\xdwdxd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\xdwdxd.exeC:\Users\Admin\AppData\Local\xdwdxd.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpA7BF.tmp.wav"' & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpA7BF.tmp.wav"'3⤵
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\tmpA7BF.tmp.wav"4⤵
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\xdwdbot.exeC:\Users\Admin\AppData\Local\xdwdbot.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x318 0x3bc1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_tdsu004r.zve.ps1
tmpA7BF.tmp.wav
xdwdxd.exe
vlc-qt-interface.ini
xdwd.dll
memory/1412-122-0x0000020970200000-0x0000020970222000-memory.dmp
memory/3308-162-0x00007FF856D00000-0x00007FF856D1B000-memory.dmp
memory/3308-149-0x00007FF857B10000-0x00007FF857B51000-memory.dmp
memory/3308-456-0x00007FF84F190000-0x00007FF84F446000-memory.dmp
memory/3308-411-0x00007FF84F190000-0x00007FF84F446000-memory.dmp
memory/3308-366-0x00007FF84F190000-0x00007FF84F446000-memory.dmp
memory/3308-140-0x00007FF873550000-0x00007FF873572000-memory.dmp
memory/3308-145-0x00007FF856DA0000-0x00007FF856E72000-memory.dmp
memory/3308-142-0x00007FF853A80000-0x00007FF853E10000-memory.dmp
memory/3308-152-0x00007FF856D70000-0x00007FF856D96000-memory.dmp
memory/3308-172-0x00007FF853140000-0x00007FF853161000-memory.dmp
memory/3308-179-0x00007FF84AE20000-0x00007FF84B065000-memory.dmp
memory/3308-178-0x00007FF852BB0000-0x00007FF852BD4000-memory.dmp
memory/3308-177-0x00007FF852BE0000-0x00007FF852C8D000-memory.dmp
memory/3308-176-0x00007FF853100000-0x00007FF853111000-memory.dmp
memory/3308-175-0x00007FF853120000-0x00007FF853131000-memory.dmp
memory/3308-174-0x00007FF871B30000-0x00007FF871B40000-memory.dmp
memory/3308-173-0x00007FF852C90000-0x00007FF852F6B000-memory.dmp
memory/3308-171-0x00007FF853170000-0x00007FF853192000-memory.dmp
memory/3308-158-0x00007FF853350000-0x00007FF8533E8000-memory.dmp
memory/3308-169-0x00007FF8540A0000-0x00007FF8540B7000-memory.dmp
memory/3308-168-0x00007FF8540C0000-0x00007FF8540D1000-memory.dmp
memory/3308-167-0x00007FF8540E0000-0x00007FF8540F7000-memory.dmp
memory/3308-166-0x00007FF854100000-0x00007FF854111000-memory.dmp
memory/3308-165-0x00007FF8531C0000-0x00007FF85329F000-memory.dmp
memory/3308-164-0x00007FF854600000-0x00007FF854611000-memory.dmp
memory/3308-163-0x00007FF854620000-0x00007FF854632000-memory.dmp
memory/3308-135-0x00007FF857360000-0x00007FF857394000-memory.dmp
memory/3308-161-0x00007FF8532A0000-0x00007FF85334B000-memory.dmp
memory/3308-134-0x00007FF6F39C0000-0x00007FF6F3AB8000-memory.dmp
memory/3308-160-0x00007FF854E60000-0x00007FF854E85000-memory.dmp
memory/3308-170-0x00007FF8531A0000-0x00007FF8531B1000-memory.dmp
memory/3308-157-0x00007FF8533F0000-0x00007FF8535FB000-memory.dmp
memory/3308-156-0x00007FF856D20000-0x00007FF856D31000-memory.dmp
memory/3308-155-0x00007FF85B0E0000-0x00007FF85B0F1000-memory.dmp
memory/3308-154-0x00007FF865850000-0x00007FF86586A000-memory.dmp
memory/3308-153-0x00007FF856D40000-0x00007FF856D6D000-memory.dmp
memory/3308-151-0x00007FF871B40000-0x00007FF871B58000-memory.dmp
memory/3308-150-0x00007FF873470000-0x00007FF87349F000-memory.dmp
memory/3308-159-0x00007FF855220000-0x00007FF85526F000-memory.dmp
memory/3308-148-0x00007FF853600000-0x00007FF8536E3000-memory.dmp
memory/3308-147-0x00007FF8536F0000-0x00007FF8537D8000-memory.dmp
memory/3308-146-0x00007FF8537E0000-0x00007FF853A76000-memory.dmp
memory/3308-141-0x00007FF873520000-0x00007FF87354B000-memory.dmp
memory/3308-139-0x00007FF873580000-0x00007FF873599000-memory.dmp
memory/3308-138-0x00007FF8735A0000-0x00007FF8735B1000-memory.dmp
memory/3308-136-0x00007FF84F190000-0x00007FF84F446000-memory.dmp
memory/3308-144-0x00007FF8734A0000-0x00007FF8734B1000-memory.dmp
memory/3308-143-0x00007FF8734F0000-0x00007FF873504000-memory.dmp
memory/3308-182-0x00007FF84F190000-0x00007FF84F446000-memory.dmp
memory/3308-274-0x00007FF84F190000-0x00007FF84F446000-memory.dmp
memory/3308-228-0x00007FF84F190000-0x00007FF84F446000-memory.dmp
memory/4328-225-0x000000001F770000-0x000000001F7F6000-memory.dmp
memory/4328-317-0x000000001F930000-0x000000001F94E000-memory.dmp
memory/4328-363-0x000000001F950000-0x000000001F962000-memory.dmp
memory/4328-137-0x00000000219A0000-0x0000000021A26000-memory.dmp
memory/4328-113-0x00000000017C0000-0x00000000017CC000-memory.dmp
memory/4328-111-0x000000001EDE0000-0x000000001EEAA000-memory.dmp
memory/4960-0-0x0000000000DE0000-0x0000000000E12000-memory.dmp