4ac4e685d2187ac67f5ed67eea0b7d2b0a31d137c35a6c85861643e16e368b7f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NursultanLoader.exe
Size 465KB
Sample240531-sywsascf41
SHA256 4ab8c02ccc707823bc0a9d2551bc8873f089ecd8d447c1bb8882b16a75f27bea
MD5 d01b5e1e47ef4095df2411ad4fba17bc
SHA1 28c133c39495cb2aa0fb04b6cd8a0be3ce5b6f54
SHA512 9aa649836d5d3d6385e4d8d393333179e6e4ee27db1cf73959e0fa4e2b154215a04e95a4c2e9980e35978d57b3df17f502c70ce502b96818b708c9036ed6e945
SSDEEP 6144:0ULhuAEZHBmkhtnLYxe6VlWT8b9isuqTLriTRNqZj7fgoUxbTR+HeI0Wpd:Zg9ZsxPVle8aG4rqjkoUR++I0Wr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\xdwdSpotify.exe"	NursultanLoader.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Loads dropped DLL 42 IoCs

pid	Process
2348	Process not Found
2524	Process not Found
2300	Process not Found
4224	Process not Found
3796	WmiApSrv.exe
2120	Process not Found
2852	Process not Found
4360	Process not Found
3324	Process not Found
3596	Process not Found
2728	Process not Found
3584	Process not Found
1656	Process not Found
2208	Process not Found
4400	Process not Found
3476	Process not Found
496	Process not Found
1460	Process not Found
1828	Process not Found
4444	Process not Found
2004	Process not Found
2672	Process not Found
3580	Process not Found
1296	Process not Found
2136	Process not Found
3928	Process not Found
3424	Process not Found
3464	Process not Found
3608	Process not Found
2700	Process not Found
2524	Process not Found
3752	Process not Found
2844	Process not Found
3500	Process not Found
2720	Process not Found
4876	Process not Found
1440	Process not Found
4080	Process not Found
1268	Process not Found
784	Process not Found
5088	Process not Found
4300	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
19	0.tcp.eu.ngrok.io

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\xdwdSpotify.exe	NursultanLoader.exe
File opened for modification	C:\Program Files\xdwdSpotify.exe	NursultanLoader.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	NursultanLoader.exe

Creates scheduled task(s) 1 TTPs 41 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2388	schtasks.exe
1992	schtasks.exe
3456	schtasks.exe
4576	schtasks.exe
4724	schtasks.exe
4612	schtasks.exe
3872	schtasks.exe
5104	schtasks.exe
2076	schtasks.exe
2152	schtasks.exe
2668	schtasks.exe
4952	schtasks.exe
4560	schtasks.exe
1284	schtasks.exe
2472	schtasks.exe
4848	schtasks.exe
364	schtasks.exe
4564	schtasks.exe
3896	schtasks.exe
1216	schtasks.exe
4596	schtasks.exe
4612	schtasks.exe
4364	schtasks.exe
3116	schtasks.exe
5060	schtasks.exe
3248	schtasks.exe
2172	schtasks.exe
1608	schtasks.exe
2032	schtasks.exe
1824	schtasks.exe
2892	schtasks.exe
4144	schtasks.exe
2372	schtasks.exe
4536	schtasks.exe
1520	schtasks.exe
664	schtasks.exe
4872	schtasks.exe
5092	schtasks.exe
1284	schtasks.exe
4604	schtasks.exe
1608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe
3788	NursultanLoader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3788	NursultanLoader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 3504	3788	NursultanLoader.exe	92
PID 3788 wrote to memory of 3504	3788	NursultanLoader.exe	92
PID 3504 wrote to memory of 2668	3504	CMD.exe	94
PID 3504 wrote to memory of 2668	3504	CMD.exe	94
PID 3788 wrote to memory of 2332	3788	NursultanLoader.exe	95
PID 3788 wrote to memory of 2332	3788	NursultanLoader.exe	95
PID 2332 wrote to memory of 2388	2332	CMD.exe	97
PID 2332 wrote to memory of 2388	2332	CMD.exe	97
PID 3788 wrote to memory of 3476	3788	NursultanLoader.exe	98
PID 3788 wrote to memory of 3476	3788	NursultanLoader.exe	98
PID 3476 wrote to memory of 4144	3476	CMD.exe	100
PID 3476 wrote to memory of 4144	3476	CMD.exe	100
PID 3788 wrote to memory of 388	3788	NursultanLoader.exe	101
PID 3788 wrote to memory of 388	3788	NursultanLoader.exe	101
PID 388 wrote to memory of 3248	388	CMD.exe	103
PID 388 wrote to memory of 3248	388	CMD.exe	103
PID 3788 wrote to memory of 940	3788	NursultanLoader.exe	105
PID 3788 wrote to memory of 940	3788	NursultanLoader.exe	105
PID 940 wrote to memory of 4564	940	CMD.exe	107
PID 940 wrote to memory of 4564	940	CMD.exe	107
PID 3788 wrote to memory of 4832	3788	NursultanLoader.exe	110
PID 3788 wrote to memory of 4832	3788	NursultanLoader.exe	110
PID 4832 wrote to memory of 4952	4832	CMD.exe	112
PID 4832 wrote to memory of 4952	4832	CMD.exe	112
PID 3788 wrote to memory of 2232	3788	NursultanLoader.exe	113
PID 3788 wrote to memory of 2232	3788	NursultanLoader.exe	113
PID 2232 wrote to memory of 2172	2232	CMD.exe	115
PID 2232 wrote to memory of 2172	2232	CMD.exe	115
PID 3788 wrote to memory of 4464	3788	NursultanLoader.exe	117
PID 3788 wrote to memory of 4464	3788	NursultanLoader.exe	117
PID 4464 wrote to memory of 2372	4464	CMD.exe	119
PID 4464 wrote to memory of 2372	4464	CMD.exe	119
PID 3788 wrote to memory of 4116	3788	NursultanLoader.exe	120
PID 3788 wrote to memory of 4116	3788	NursultanLoader.exe	120
PID 4116 wrote to memory of 1992	4116	CMD.exe	122
PID 4116 wrote to memory of 1992	4116	CMD.exe	122
PID 3788 wrote to memory of 1460	3788	NursultanLoader.exe	123
PID 3788 wrote to memory of 1460	3788	NursultanLoader.exe	123
PID 1460 wrote to memory of 4612	1460	CMD.exe	125
PID 1460 wrote to memory of 4612	1460	CMD.exe	125
PID 3788 wrote to memory of 4788	3788	NursultanLoader.exe	126
PID 3788 wrote to memory of 4788	3788	NursultanLoader.exe	126
PID 4788 wrote to memory of 4536	4788	CMD.exe	128
PID 4788 wrote to memory of 4536	4788	CMD.exe	128
PID 3788 wrote to memory of 2244	3788	NursultanLoader.exe	129
PID 3788 wrote to memory of 2244	3788	NursultanLoader.exe	129
PID 2244 wrote to memory of 5092	2244	CMD.exe	131
PID 2244 wrote to memory of 5092	2244	CMD.exe	131
PID 3788 wrote to memory of 4828	3788	NursultanLoader.exe	132
PID 3788 wrote to memory of 4828	3788	NursultanLoader.exe	132
PID 4828 wrote to memory of 4364	4828	CMD.exe	134
PID 4828 wrote to memory of 4364	4828	CMD.exe	134
PID 3788 wrote to memory of 4232	3788	NursultanLoader.exe	135
PID 3788 wrote to memory of 4232	3788	NursultanLoader.exe	135
PID 4232 wrote to memory of 1284	4232	CMD.exe	137
PID 4232 wrote to memory of 1284	4232	CMD.exe	137
PID 3788 wrote to memory of 3616	3788	NursultanLoader.exe	138
PID 3788 wrote to memory of 3616	3788	NursultanLoader.exe	138
PID 3616 wrote to memory of 1520	3616	CMD.exe	140
PID 3616 wrote to memory of 1520	3616	CMD.exe	140
PID 3788 wrote to memory of 1988	3788	NursultanLoader.exe	141
PID 3788 wrote to memory of 1988	3788	NursultanLoader.exe	141
PID 1988 wrote to memory of 3456	1988	CMD.exe	143
PID 1988 wrote to memory of 3456	1988	CMD.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NursultanLoader.exe
"C:\Users\Admin\AppData\Local\Temp\NursultanLoader.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "GIMP (GNU Image Manipulation Program)" /tr "C:\Program Files\xdwdSpotify.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "GIMP (GNU Image Manipulation Program)" /tr "C:\Program Files\xdwdSpotify.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2668
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Zoom" /tr "C:\Users\Admin\AppData\Roaming\xdwdMalwarebytes Update.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Zoom" /tr "C:\Users\Admin\AppData\Roaming\xdwdMalwarebytes Update.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4144
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2172
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2372
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4536
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5092
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3456
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4560
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4788
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:5056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1608
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:2700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4896
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4604
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:3912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4312
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:3868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1608
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:1144
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2032
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4360
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:2456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1216
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:1520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:664
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:2452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5104
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:1124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4848
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:3676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:2368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:608
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:1108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:3192
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2076
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:1992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2152
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:1012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2892

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
PID:3796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3788-0-0x00007FFEB35E3000-0x00007FFEB35E5000-memory.dmp

Download

memory/3788-1-0x0000000000EA0000-0x0000000000F1A000-memory.dmp

Download

memory/3788-45-0x00007FFEB35E0000-0x00007FFEB40A1000-memory.dmp

Download

memory/3788-106-0x0000000001850000-0x000000000185C000-memory.dmp

Download

memory/3788-105-0x000000001D220000-0x000000001D296000-memory.dmp

Download

memory/3788-107-0x0000000003140000-0x000000000315E000-memory.dmp

Download

memory/3788-139-0x00007FFEB35E3000-0x00007FFEB35E5000-memory.dmp

Download

memory/3788-264-0x00007FFEB35E0000-0x00007FFEB40A1000-memory.dmp

Download