General
- Target Holy Check.exe
- Size 445KB
- Sample261024-vmxassa18v
- SHA256 41e33d2a84887bfb81f3ffa85ee56d2c5d1b87729c7fccdde6e65ef4afa928a8
Malware Config
Targets
-
- Target Holy Check.exe
- Size 445KB
- SHA256 41e33d2a84887bfb81f3ffa85ee56d2c5d1b87729c7fccdde6e65ef4afa928a8
Score10/10-
Detects Sheetrat Payload
Sheetrat aka NonEuclid RAT is a trojan written in C#.
-
Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender TamperProtection settings
-
UAC bypass
-
Modifies Windows Firewall
-
Creates new service(s)
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Stops running service(s)
-
Windows security modification
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
4Masquerading
1Match Legitimate Name or Location
1Modify Registry
5