c23029f315f2d0063ffaef0cb651cfcf8e39bd4f9d77aefb6a5866d73bf096db

Analysis

max time kernel
147s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
07/10/2025, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Neverlose.exe
Size 467KB
Sample251007-wsw3na1mt9
SHA256 c23029f315f2d0063ffaef0cb651cfcf8e39bd4f9d77aefb6a5866d73bf096db
MD5 a06af79760ce1677eb8549bfb6a2d190
SHA1 bfb462f98e256e0532f97fcdefad18009427ca36
SHA512 c66ab1d94beb5e8c51b464f131d2e9caf7728f9f9af4db0d9c6fbcd2be14d6b61d8b3dc4d9f80d5d19e17bded64c7d54185c14f6ed74d235e902b779cebe1c70
SSDEEP 6144:RmFJVUH/x2qize6VlWT8b9MkKmdIwQbe/j:QDWdKPVle8CEqwn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\xdwdMicrosoft Security Essentials.exe"	Neverlose.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 2 IoCs

pid	Process
4960	xdwdRainmeter.exe
1672	xdwdMicrosoft Security Essentials.exe

Loads dropped DLL 52 IoCs

pid	Process
4564	Process not Found
4872	Process not Found
4796	Process not Found
4960	xdwdRainmeter.exe
904	Process not Found
1904	Process not Found
3928	Process not Found
2384	Process not Found
5716	Process not Found
6000	Process not Found
5364	Process not Found
1012	Process not Found
4608	Process not Found
1672	xdwdMicrosoft Security Essentials.exe
5688	Process not Found
2168	Process not Found
2772	Process not Found
3048	Process not Found
1520	Process not Found
3368	Process not Found
2304	Process not Found
444	Process not Found
5544	Process not Found
4712	Process not Found
3020	Process not Found
5484	Process not Found
1136	Process not Found
2368	Process not Found
4340	Process not Found
5288	Process not Found
3856	Process not Found
4644	Process not Found
2396	Process not Found
2348	Process not Found
2020	Process not Found
5592	Process not Found
4988	Process not Found
1376	Process not Found
4948	Process not Found
5100	Process not Found
4120	Process not Found
3324	Process not Found
5664	Process not Found
2812	WmiApSrv.exe
4660	Process not Found
5396	Process not Found
3984	Process not Found
2992	Process not Found
4740	Process not Found
5776	Process not Found
6048	Process not Found
972	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Windows\CurrentVersion\Run\xdwdfghfghfg = "C:\\Users\\Public\\Pictures\\xdwdRainmeter.exe"	Neverlose.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Neverlose.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xdwdRainmeter.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5320	schtasks.exe
4292	schtasks.exe
3592	schtasks.exe
1748	schtasks.exe
3408	schtasks.exe
5404	schtasks.exe
3128	schtasks.exe
568	schtasks.exe
6028	schtasks.exe
1296	schtasks.exe
4064	schtasks.exe
3900	schtasks.exe
1480	schtasks.exe
5816	schtasks.exe
2660	schtasks.exe
4168	schtasks.exe
6048	schtasks.exe
2500	schtasks.exe
5652	schtasks.exe
3816	schtasks.exe
1648	schtasks.exe
1256	schtasks.exe
2000	schtasks.exe
1496	schtasks.exe
4344	schtasks.exe
1208	schtasks.exe
1484	schtasks.exe
3700	schtasks.exe
3480	schtasks.exe
1312	schtasks.exe
2320	schtasks.exe
3836	schtasks.exe
3660	schtasks.exe
972	schtasks.exe
2088	schtasks.exe
4380	schtasks.exe
3352	schtasks.exe
5716	schtasks.exe
4316	schtasks.exe
1348	schtasks.exe
2700	schtasks.exe
3692	schtasks.exe
5612	schtasks.exe
5720	schtasks.exe
4992	schtasks.exe
5068	schtasks.exe
836	schtasks.exe
4776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
4960	xdwdRainmeter.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2100	Neverlose.exe
2812	WmiApSrv.exe
2812	WmiApSrv.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	Neverlose.exe
Token: SeDebugPrivilege	4960	xdwdRainmeter.exe
Token: SeDebugPrivilege	1672	xdwdMicrosoft Security Essentials.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1792	2100	Neverlose.exe	79
PID 2100 wrote to memory of 1792	2100	Neverlose.exe	79
PID 1792 wrote to memory of 2320	1792	CMD.exe	81
PID 1792 wrote to memory of 2320	1792	CMD.exe	81
PID 2100 wrote to memory of 2912	2100	Neverlose.exe	82
PID 2100 wrote to memory of 2912	2100	Neverlose.exe	82
PID 2912 wrote to memory of 4316	2912	CMD.exe	84
PID 2912 wrote to memory of 4316	2912	CMD.exe	84
PID 2100 wrote to memory of 5368	2100	Neverlose.exe	85
PID 2100 wrote to memory of 5368	2100	Neverlose.exe	85
PID 5368 wrote to memory of 4992	5368	CMD.exe	89
PID 5368 wrote to memory of 4992	5368	CMD.exe	89
PID 2100 wrote to memory of 4652	2100	Neverlose.exe	91
PID 2100 wrote to memory of 4652	2100	Neverlose.exe	91
PID 4652 wrote to memory of 3836	4652	CMD.exe	93
PID 4652 wrote to memory of 3836	4652	CMD.exe	93
PID 4884 wrote to memory of 4960	4884	cmd.exe	90
PID 4884 wrote to memory of 4960	4884	cmd.exe	90
PID 2100 wrote to memory of 2364	2100	Neverlose.exe	94
PID 2100 wrote to memory of 2364	2100	Neverlose.exe	94
PID 2364 wrote to memory of 5068	2364	CMD.exe	96
PID 2364 wrote to memory of 5068	2364	CMD.exe	96
PID 2100 wrote to memory of 4488	2100	Neverlose.exe	97
PID 2100 wrote to memory of 4488	2100	Neverlose.exe	97
PID 4488 wrote to memory of 2660	4488	CMD.exe	99
PID 4488 wrote to memory of 2660	4488	CMD.exe	99
PID 2100 wrote to memory of 5496	2100	Neverlose.exe	100
PID 2100 wrote to memory of 5496	2100	Neverlose.exe	100
PID 5496 wrote to memory of 1208	5496	CMD.exe	102
PID 5496 wrote to memory of 1208	5496	CMD.exe	102
PID 2100 wrote to memory of 2616	2100	Neverlose.exe	103
PID 2100 wrote to memory of 2616	2100	Neverlose.exe	103
PID 2616 wrote to memory of 3660	2616	CMD.exe	105
PID 2616 wrote to memory of 3660	2616	CMD.exe	105
PID 2100 wrote to memory of 3628	2100	Neverlose.exe	106
PID 2100 wrote to memory of 3628	2100	Neverlose.exe	106
PID 3628 wrote to memory of 6028	3628	CMD.exe	108
PID 3628 wrote to memory of 6028	3628	CMD.exe	108
PID 4960 wrote to memory of 6112	4960	xdwdRainmeter.exe	109
PID 4960 wrote to memory of 6112	4960	xdwdRainmeter.exe	109
PID 6112 wrote to memory of 4168	6112	CMD.exe	111
PID 6112 wrote to memory of 4168	6112	CMD.exe	111
PID 2100 wrote to memory of 1924	2100	Neverlose.exe	112
PID 2100 wrote to memory of 1924	2100	Neverlose.exe	112
PID 1924 wrote to memory of 1484	1924	CMD.exe	114
PID 1924 wrote to memory of 1484	1924	CMD.exe	114
PID 2100 wrote to memory of 2152	2100	Neverlose.exe	116
PID 2100 wrote to memory of 2152	2100	Neverlose.exe	116
PID 2152 wrote to memory of 1296	2152	CMD.exe	118
PID 2152 wrote to memory of 1296	2152	CMD.exe	118
PID 2100 wrote to memory of 4604	2100	Neverlose.exe	119
PID 2100 wrote to memory of 4604	2100	Neverlose.exe	119
PID 4604 wrote to memory of 4064	4604	CMD.exe	121
PID 4604 wrote to memory of 4064	4604	CMD.exe	121
PID 4960 wrote to memory of 1672	4960	xdwdRainmeter.exe	115
PID 4960 wrote to memory of 1672	4960	xdwdRainmeter.exe	115
PID 2100 wrote to memory of 1840	2100	Neverlose.exe	122
PID 2100 wrote to memory of 1840	2100	Neverlose.exe	122
PID 1840 wrote to memory of 6048	1840	CMD.exe	124
PID 1840 wrote to memory of 6048	1840	CMD.exe	124
PID 2100 wrote to memory of 1240	2100	Neverlose.exe	125
PID 2100 wrote to memory of 1240	2100	Neverlose.exe	125
PID 1240 wrote to memory of 972	1240	CMD.exe	127
PID 1240 wrote to memory of 972	1240	CMD.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Neverlose.exe
"C:\Users\Admin\AppData\Local\Temp\Neverlose.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Neverlose" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Neverlose" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4316
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Evernote" /tr "C:\Users\Public\Pictures\xdwdRainmeter.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Evernote" /tr "C:\Users\Public\Pictures\xdwdRainmeter.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3836
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2660
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3660
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6028
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1484
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1296
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4064
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:3412
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:836
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:1700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2500
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:3728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:5416
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:5536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:3568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:2764
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:5508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:5848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:5896
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5652
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:2132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4380
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:5624
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1348
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:1956
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2700
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:3688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4292
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:3680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:2376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:1944
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:3564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5404
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:4856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1496
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:4444
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1312
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:4396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:5116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3592
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:4916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:3732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:5400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:1712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5716
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:6132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3128
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:3784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3816
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:568
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:5424
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4344
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
  2⤵
  PID:5984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Public\Pictures\xdwdRainmeter.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Public\Pictures\xdwdRainmeter.exe
  C:\Users\Public\Pictures\xdwdRainmeter.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6112
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4168
- - C:\Users\Admin\xdwdMicrosoft Security Essentials.exe
    "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
      4⤵
      PID:5608
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1648
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST & exit
      4⤵
      PID:2264
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "MATLAB" /tr "C:\Users\Admin\xdwdMicrosoft Security Essentials.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2088

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2100-0-0x0000000000350000-0x00000000003CA000-memory.dmp

Download

memory/2100-31-0x000000001CC40000-0x000000001CC50000-memory.dmp

Download

memory/2100-95-0x000000001CC40000-0x000000001CC50000-memory.dmp

Download

memory/2100-179-0x000000001E000000-0x000000001E076000-memory.dmp

Download

memory/2100-180-0x000000001CC20000-0x000000001CC2C000-memory.dmp

Download

memory/2100-181-0x000000001DC60000-0x000000001DC7E000-memory.dmp

Download