Analysis
- user interaction
yes - max time kernel
900s - max time network
896s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
10/11/2026, 08:59
General
- Target RatKiller.bat
- Size 866KB
- Sample261110-kxp95av13l
- SHA256 d17c6931ad3004fe7886d578a7ba5efdc5d5645aa52f251cf3736d432b6610c3
Malware Config
Extracted
-
sheetrat
-
2.6.4
-
openport.pw:35240
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detects Sheetrat obfuscated V1.8 and higher 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat obfuscated version 2 IoCs
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 14 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs
Payload decoded via CertUtil.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 12 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RatKiller.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -decode "C:\Users\Admin\AppData\Local\Temp\RatKiller.bat" "RatKiller.exe"2⤵
- Deobfuscate/Decode Files or Information
-
-
C:\Users\Admin\AppData\Local\Temp\RatKiller.exe"RatKiller.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Executes dropped EXE
- Windows security modification
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeSchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Sub\xdwdRuntimeBroker.exeC:\Windows\Sub\xdwdRuntimeBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Sub\RuntimeBroker.exeC:\Windows\Sub\RuntimeBroker.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Deobfuscate/Decode Files or Information
1Impair Defenses
4Disable or Modify Tools
4Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
RatKiller.exe
__PSScriptPolicyTest_o04qu2uj.1li.ps1
tmp2470.tmp.dat
tmp2472.tmp.dat
tmp2473.tmp.dat
tmp24B3.tmp.dat
zudrd5vn.o2p.zip
Bookmarks.txt
Cookies.txt
xdwd.dll
memory/2648-107-0x00007FF941CB0000-0x00007FF941CD2000-memory.dmp
memory/2648-96-0x00007FF941CB0000-0x00007FF941CD2000-memory.dmp
memory/2648-103-0x000001625BB70000-0x000001625BB92000-memory.dmp
memory/3888-80-0x00007FF941CB0000-0x00007FF941CD2000-memory.dmp
memory/3888-77-0x00007FF941CB0000-0x00007FF941CD2000-memory.dmp
memory/3928-82-0x00007FF941CB0000-0x00007FF941CD2000-memory.dmp
memory/3928-72-0x00007FF941CB0000-0x00007FF941CD2000-memory.dmp
memory/4132-92-0x000000001D610000-0x000000001D756000-memory.dmp
memory/4132-108-0x000000001D850000-0x000000001D8EA000-memory.dmp
memory/4132-93-0x0000000002DD0000-0x0000000002DDA000-memory.dmp
memory/4132-89-0x000000001D0E0000-0x000000001D0FE000-memory.dmp
memory/4132-88-0x000000001BE60000-0x000000001BE6A000-memory.dmp
memory/4132-87-0x000000001DFC0000-0x000000001E036000-memory.dmp
memory/4132-83-0x000000001BEC0000-0x000000001BED0000-memory.dmp
memory/4132-21-0x000000001BEC0000-0x000000001BED0000-memory.dmp
memory/4132-4-0x0000000000BB0000-0x0000000000C58000-memory.dmp