Analysis
- geolocation tags
- user interaction
yes - max time kernel
16s - max time network
16s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
04/11/2026, 18:44
General
- Target see3.ps1
- Size 4KB
- Sample261104-xdmfcacw4v
- SHA256 d65fed8b11f15086fd4024678bd487c0b0bdc144fab2be12d4fb37239156ef07
Malware Config
Extracted
-
sheetrat
-
1.8
-
AYU
-
wuohzjgoj.localto.net:3837
-
anti_virtual
false
-
certificate
wnem76c5s1bgpucn
-
install
false
-
key
b9sv30zmw
-
path_watch_dog
69)qrk5
-
rootkit
akyyJj3Ja
-
use_install_admin
9f)mc0sndjvwho
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects DonutLoader 2 IoCs
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of FindShellTrayWindow 23 IoCs
- Suspicious use of SendNotifyMessage 21 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\see3.ps12⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gkjzxahy\gkjzxahy.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD889.tmp" "c:\Users\Admin\AppData\Local\Temp\gkjzxahy\CSCF7CF467A697B4587AC3F50A9B84C26BF.TMP"4⤵
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESD889.tmp
__PSScriptPolicyTest_czzygwsu.u0f.ps1
gkjzxahy.dll
CSCF7CF467A697B4587AC3F50A9B84C26BF.TMP
gkjzxahy.0.cs
gkjzxahy.cmdline
memory/2828-29-0x000001B56D910000-0x000001B56D920000-memory.dmp
memory/2828-0-0x000001B56D910000-0x000001B56D920000-memory.dmp
memory/2828-8-0x000001B56FB00000-0x000001B56FB22000-memory.dmp
memory/2828-23-0x000001B5554A0000-0x000001B5554A8000-memory.dmp
memory/2828-1-0x000001B56D910000-0x000001B56D920000-memory.dmp
memory/2828-24-0x000001B56D910000-0x000001B56D920000-memory.dmp
memory/2828-33-0x000001B56D910000-0x000001B56D920000-memory.dmp
memory/2828-10-0x000001B56D910000-0x000001B56D920000-memory.dmp
memory/2828-31-0x000001B56D910000-0x000001B56D920000-memory.dmp
memory/2828-30-0x000001B56D910000-0x000001B56D920000-memory.dmp
memory/3328-32-0x00007FFEB7F5F000-0x00007FFEB7F60000-memory.dmp
memory/3328-28-0x0000000008B40000-0x0000000008B50000-memory.dmp
memory/3328-27-0x0000000002D60000-0x0000000002D70000-memory.dmp
memory/3328-26-0x0000000008B40000-0x0000000008B50000-memory.dmp
memory/3328-25-0x0000000000E50000-0x0000000000E64000-memory.dmp
memory/3328-34-0x0000000008B40000-0x0000000008B50000-memory.dmp
memory/3328-48-0x0000000008B40000-0x0000000008B50000-memory.dmp
memory/4012-41-0x000001CE6D9A0000-0x000001CE6D9A1000-memory.dmp
memory/4012-36-0x000001CE6D9A0000-0x000001CE6D9A1000-memory.dmp
memory/4012-37-0x000001CE6D9A0000-0x000001CE6D9A1000-memory.dmp
memory/4012-47-0x000001CE6D9A0000-0x000001CE6D9A1000-memory.dmp
memory/4012-46-0x000001CE6D9A0000-0x000001CE6D9A1000-memory.dmp
memory/4012-45-0x000001CE6D9A0000-0x000001CE6D9A1000-memory.dmp
memory/4012-44-0x000001CE6D9A0000-0x000001CE6D9A1000-memory.dmp
memory/4012-43-0x000001CE6D9A0000-0x000001CE6D9A1000-memory.dmp
memory/4012-42-0x000001CE6D9A0000-0x000001CE6D9A1000-memory.dmp
memory/4012-35-0x000001CE6D9A0000-0x000001CE6D9A1000-memory.dmp