sheetrat | 1a313ee4c23d0a806470736f2bf29f98d303e83be700a48b0ec0a6ac5a5699f1

Analysis

user interaction
yes
max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29liy2qrifay1v5q.exe
Size 41KB
Sample261027-mpff3adc52
SHA256 1a313ee4c23d0a806470736f2bf29f98d303e83be700a48b0ec0a6ac5a5699f1
MD5 739b16f48d1ebd37f112d8cc5b45ff49
SHA1 bd8eac59ee58e23a40e9cf23ed5b6b5b2ed16548
SHA512 6ae83341ca24e2192f7137fd6af921f566912ebe76711e9134507ab3a79a70df00b5a4d18883937ea957643bd4d27e5f9c78c875c5837a1af8a582da2fda1ee7
SSDEEP 768:RSZ55fCR6FLrp49p5DamrHnj0Obd66w/f/Pm:RSdFvApJ9wObodf+
TLSH
T10C13394073D84E24D2EF4EBDB962964852B1E1534813DB1E2ECB5CE82533BD89A51FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery sheetrat trojan

Malware Config

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/752-0-0x000001ADA5060000-0x000001ADA506E000-memory.dmp	family_sheetrat_v1

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	29liy2qrifay1v5q.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	29liy2qrifay1v5q.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	752	29liy2qrifay1v5q.exe

C:\Users\Admin\AppData\Local\Temp\29liy2qrifay1v5q.exe
"C:\Users\Admin\AppData\Local\Temp\29liy2qrifay1v5q.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-0-0x000001ADA5060000-0x000001ADA506E000-memory.dmp

Download