Analysis
- user interaction
yes - max time kernel
900s - max time network
897s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/11/2026, 20:02
General
- Target ckleukaa.exe
- Size 842KB
- Sample261101-ysgn3sdb87
- SHA256 a15e7efb966979b38003984e316de8732ab00b66040dc97294dc13822964cb58
Malware Config
Extracted
-
sheetrat
-
2.6.4
-
Sheet_wvnkneyyxn
-
openport.pw:30265
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat obfuscated V1.8 and higher 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat obfuscated version 2 IoCs
- Executes dropped EXE 5 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Start PowerShell.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ckleukaa.exe"C:\Users\Admin\AppData\Local\Temp\ckleukaa.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeSchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ynkq5mnn.fsn.exe"' & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ynkq5mnn.fsn.exe"'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ynkq5mnn.fsn.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ynkq5mnn.fsn.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kxlq3qmj.ge4.exe"' & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kxlq3qmj.ge4.exe"'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kxlq3qmj.ge4.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kxlq3qmj.ge4.exe"5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XBinder v2.exe"C:\Users\Admin\AppData\Local\Temp\XBinder v2.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Users\Admin\AppData\Local\Temp\Client.exeC:\Users\Admin\AppData\Local\Temp\Client.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
Client.exe
XBinder v2.exe
__PSScriptPolicyTest_pq1iexst.sb4.psm1
kxlq3qmj.ge4.exe
ynkq5mnn.fsn.exe
memory/1828-63-0x0000000000080000-0x000000000008A000-memory.dmp
memory/3720-1-0x0000000000790000-0x0000000000868000-memory.dmp
memory/3720-22-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3720-4-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3720-2-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3720-0-0x00007FFE6AA5F000-0x00007FFE6AA60000-memory.dmp
memory/4196-46-0x000002219F640000-0x000002219F662000-memory.dmp
memory/4748-41-0x0000000002680000-0x000000000269E000-memory.dmp
memory/4748-40-0x000000001BB90000-0x000000001BCD6000-memory.dmp
memory/4748-20-0x0000000000360000-0x0000000000408000-memory.dmp
memory/4748-23-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/4748-24-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/4748-25-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/4748-26-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/4748-35-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/4748-42-0x0000000002590000-0x000000000259C000-memory.dmp
memory/4748-39-0x000000001B900000-0x000000001B976000-memory.dmp
memory/5108-21-0x0000027768F10000-0x000002776929E000-memory.dmp
memory/5108-27-0x000002776D500000-0x000002776D59C000-memory.dmp
memory/5108-37-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/5108-36-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/5108-33-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/5108-32-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/5108-115-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/5108-31-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/5108-30-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/5108-29-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/5108-28-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/5764-75-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-92-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-54-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-53-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-52-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-64-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-65-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-66-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-67-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-68-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-69-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-70-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-73-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-74-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-51-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-76-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-77-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-78-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-79-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-80-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-81-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-82-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-83-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-84-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-85-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-86-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-87-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-88-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-89-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-90-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-91-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-55-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-93-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-94-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-95-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-96-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-97-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-98-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-99-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-100-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-101-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-102-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-103-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-104-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-105-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-106-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-107-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-108-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-109-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-110-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-111-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-112-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-113-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-114-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-50-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-116-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-117-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-118-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-119-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-120-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-121-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-122-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-123-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5764-124-0x0000000000400000-0x00000000004FE000-memory.dmp