Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 18:10
General
- Target Server.exe
- Size 31.8MB
- Sample261029-wr1pfsey6q
- SHA256 daad13108b1374960b6dec1f484cc012fe98e4e2293e2f0929bbaf121e63f884
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
System.Data.SQLite.dll
memory/4132-0-0x00007FF9F076F000-0x00007FF9F0770000-memory.dmp
memory/4132-1-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-2-0x000001A776680000-0x000001A77864E000-memory.dmp
memory/4132-3-0x000001A77AC80000-0x000001A77B2F4000-memory.dmp
memory/4132-4-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-6-0x000001A77B2F0000-0x000001A77B764000-memory.dmp
memory/4132-13-0x000001A77B9C0000-0x000001A77BAE6000-memory.dmp
memory/4132-15-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-28-0x000001A77AC30000-0x000001A77AC38000-memory.dmp
memory/4132-39-0x000001A77C630000-0x000001A77C644000-memory.dmp
memory/4132-55-0x000001A77C6E0000-0x000001A77C6F2000-memory.dmp
memory/4132-74-0x000001A77C860000-0x000001A77C86C000-memory.dmp
memory/4132-77-0x000001A77C8E0000-0x000001A77C94A000-memory.dmp
memory/4132-121-0x000001A77CDA0000-0x000001A77CDB0000-memory.dmp
memory/4132-119-0x000001A77CCB0000-0x000001A77CCCA000-memory.dmp
memory/4132-117-0x000001A77CCE0000-0x000001A77CD98000-memory.dmp
memory/4132-115-0x000001A77CCD0000-0x000001A77CCD8000-memory.dmp
memory/4132-114-0x000001A77CCB0000-0x000001A77CCB8000-memory.dmp
memory/4132-112-0x000001A77CCA0000-0x000001A77CCAA000-memory.dmp
memory/4132-110-0x000001A77CC00000-0x000001A77CCA0000-memory.dmp
memory/4132-108-0x000001A77CBE0000-0x000001A77CBF6000-memory.dmp
memory/4132-106-0x000001A77CBD0000-0x000001A77CBD8000-memory.dmp
memory/4132-104-0x000001A77CBC0000-0x000001A77CBC8000-memory.dmp
memory/4132-102-0x000001A77CBB0000-0x000001A77CBBC000-memory.dmp
memory/4132-100-0x000001A77CBA0000-0x000001A77CBA8000-memory.dmp
memory/4132-98-0x000001A77CB80000-0x000001A77CBA0000-memory.dmp
memory/4132-96-0x000001A77CB00000-0x000001A77CB80000-memory.dmp
memory/4132-94-0x000001A77CAE0000-0x000001A77CAFE000-memory.dmp
memory/4132-92-0x000001A77CAB0000-0x000001A77CAD8000-memory.dmp
memory/4132-90-0x000001A77CA90000-0x000001A77CAA8000-memory.dmp
memory/4132-88-0x000001A77C8C0000-0x000001A77C8D6000-memory.dmp
memory/4132-86-0x000001A77CA50000-0x000001A77CA84000-memory.dmp
memory/4132-84-0x000001A77C880000-0x000001A77C8B4000-memory.dmp
memory/4132-72-0x000001A77C820000-0x000001A77C862000-memory.dmp
memory/4132-70-0x000001A77C810000-0x000001A77C81C000-memory.dmp
memory/4132-68-0x000001A77C800000-0x000001A77C80A000-memory.dmp
memory/4132-65-0x000001A77C7F0000-0x000001A77C7FE000-memory.dmp
memory/4132-63-0x000001A77C740000-0x000001A77C7F2000-memory.dmp
memory/4132-61-0x000001A77C730000-0x000001A77C744000-memory.dmp
memory/4132-59-0x000001A77C720000-0x000001A77C730000-memory.dmp
memory/4132-57-0x000001A77C6F0000-0x000001A77C722000-memory.dmp
memory/4132-53-0x000001A77C6D0000-0x000001A77C6D8000-memory.dmp
memory/4132-51-0x000001A77C6A0000-0x000001A77C6D4000-memory.dmp
memory/4132-49-0x000001A77C690000-0x000001A77C69E000-memory.dmp
memory/4132-47-0x000001A77C680000-0x000001A77C68A000-memory.dmp
memory/4132-45-0x000001A77C670000-0x000001A77C680000-memory.dmp
memory/4132-43-0x000001A77C650000-0x000001A77C664000-memory.dmp
memory/4132-41-0x000001A77C640000-0x000001A77C64A000-memory.dmp
memory/4132-37-0x000001A77C620000-0x000001A77C630000-memory.dmp
memory/4132-35-0x000001A77AC60000-0x000001A77AC6C000-memory.dmp
memory/4132-33-0x000001A77AC50000-0x000001A77AC5A000-memory.dmp
memory/4132-31-0x000001A77AC40000-0x000001A77AC4A000-memory.dmp
memory/4132-26-0x000001A77AC20000-0x000001A77AC2A000-memory.dmp
memory/4132-24-0x000001A77AC10000-0x000001A77AC18000-memory.dmp
memory/4132-22-0x000001A778B40000-0x000001A778B6C000-memory.dmp
memory/4132-20-0x000001A77A440000-0x000001A77A492000-memory.dmp
memory/4132-18-0x000001A77AB60000-0x000001A77ABF4000-memory.dmp
memory/4132-16-0x000001A77BAE0000-0x000001A77BFA6000-memory.dmp
memory/4132-12-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-10-0x000001A778B10000-0x000001A778B2C000-memory.dmp
memory/4132-8-0x000001A77B770000-0x000001A77B9C2000-memory.dmp
memory/4132-122-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-123-0x000001A77CFB0000-0x000001A77CFD2000-memory.dmp
memory/4132-125-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-126-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-127-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-133-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-134-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-135-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-136-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-137-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-138-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-139-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-140-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/4132-141-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp