NonEuclid RAT

Persistence – Schedule Task The Schtasks method creates a scheduled task using the Windows command line.

When executed, the malware drops two executable files in different folders. These files are configured to run automatically via the Task Scheduler, ensuring they remain persistent

MITRE ATTACK FRAMEWORK Sr. No. 1 Execution T1059 Command and Scripting Interpreter

MITRE ATTACK FRAMEWORK Sr. No. 1 Execution T1106 Native API

Persistence – Schedule Task The Schtasks method creates a scheduled task using the Windows command line.

When executed, the malware drops two executable files in different folders. These files are configured to run automatically via the Task Scheduler, ensuring they remain persistent

The below AntiScan method attempts to bypass Windows Defender’s scans by adding exclusions to the Defender registry settings.

MITRE ATTACK FRAMEWORK Sr. No. 2 Persistence T1505 Server Software Component

MITRE ATTACK FRAMEWORK Sr. No. 2 Persistence T1547 Boot or Logon Autostart Execution

Persistence – Registry Value changes The HKCU method updates a specific registry key under HKEY_CURRENT_USER to store a given Name.

Persistence – Schedule Task The Schtasks method creates a scheduled task using the Windows command line.

When executed, the malware drops two executable files in different folders. These files are configured to run automatically via the Task Scheduler, ensuring they remain persistent

MITRE ATTACK FRAMEWORK Sr. No. 2 Persistence T1547 Boot or Logon Autostart Execution

Persistence – Registry Value changes The HKCU method updates a specific registry key under HKEY_CURRENT_USER to store a given Name.

MITRE ATTACK FRAMEWORK Sr. No. 3 Privilege Escalation T1548.001 Bypass Elevation Control

Privilege escalation- UAC Bypass The Bypass method attempts to manipulate the Windows registry and execute a command to bypass certain restrictions.

The below AntiScan method attempts to bypass Windows Defender’s scans by adding exclusions to the Defender registry settings. It modifies the registry paths dynamically (by removing obfuscation placeholders like “button” and “UIUSS”).

MITRE ATTACK FRAMEWORK Sr. No. 4 Defense Evasion T1027.004 Compile After Delivery

MITRE ATTACK FRAMEWORK Sr. No. 4 Defense Evasion T1070 Indicator Removal

MITRE ATTACK FRAMEWORK Sr. No. 4 Defense Evasion T1070.006 Timestomp

MITRE ATTACK FRAMEWORK Sr. No. 4 Defense Evasion T1140 Deobfuscate/Decode Files

Anti VM: The RunAntiAnalysis method checks if the program is running in a virtual machine (VM)... If no objects are found ... the program terminates with exit code 240, acting as an anti-analysis mechanism.

This method queries system information (Win32_CacheMemory) to detect the presence of memory objects indicative of a physical machine.

Dynamically loading DLL: This code defines a method to dynamically invoke Windows API functions using their DLL names and function names.

The below AntiScan method attempts to bypass Windows Defender’s scans by adding exclusions to the Defender registry settings.

MITRE ATTACK FRAMEWORK Sr. No. 4 Defense Evasion T1222 File and Directory Permissions

NonEuclid uses a plugin to brute force SSH and FTP credentials.

MITRE ATTACK FRAMEWORK Sr. No. 5 Discovery T1012 Query Registry

MITRE ATTACK FRAMEWORK Sr. No. 5 Discovery T1033 System Owner/User Discovery

It uses Windows API calls (CreateToolhelp32Snapshot, Process32First, Process32Next) to enumerate processes and check if their executable names match the specified targets.

This method queries system information (Win32_CacheMemory) to detect the presence of memory objects indicative of a physical machine.

The developer behind the ransomware is utilizing AES encryption to lock various file types, including those with extensions such as “.csv”, “.txt”, and “.php”.

MITRE ATTACK FRAMEWORK Sr. No. 5 Discovery T1087 Account Discovery

Anti VM: The RunAntiAnalysis method checks if the program is running in a virtual machine (VM)... If no objects are found ... the program terminates with exit code 240, acting as an anti-analysis mechanism.

This method queries system information (Win32_CacheMemory) to detect the presence of memory objects indicative of a physical machine.

The below Block method continuously monitors running processes to detect and terminate specific target processes like “Taskmgr.exe”, “ProcessHacker.exe”, and “procexp.exe”.

It enables critical process handling (BSOD), performs anti-defender scans...

MITRE ATTACK FRAMEWORK Sr. No. 5 Discovery T1614 System Location Discovery

NonEuclid uses a plugin that collects geolocation data from compromised systems.

NonEuclid uses a plugin that monitors the clipboard to intercept and replace cryptocurrency wallet addresses.

This method initializes a TCP socket... wraps the socket in a NetworkStream, configures timers for keep-alive and pong packets, and starts asynchronous reading for server data.

MITRE ATTACK FRAMEWORK Sr. No. 6 Command and Control T1071.001 Web Protocols

MITRE ATTACK FRAMEWORK Sr. No. 7 Exfiltration T1041 Exfiltration Over Command-and-Control Channel

The developer behind the ransomware is utilizing AES encryption to lock various file types... After encryption, each affected file is renamed with the extension “.NonEuclid”.

It employs various mechanisms, including antivirus bypass...

The below Block method continuously monitors running processes to detect and terminate specific target processes like “Taskmgr.exe”, “ProcessHacker.exe”, and “procexp.exe”. | ASMI (Antimalware Scan Interface) Bypass: The code below searches for the “amsi.dll” module... modify specific memory regions related to “AmsiScanBuffer”