sheetrat | dacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe
Size 4.3MB
Sample260423-wmpfmacz3m
SHA256 dacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944
MD5 7c2805150c8a4d3effc43ccac18048f5
SHA1 d6174c96fec5ae3cd9fecfb2fe9d6e8a2b794b84
SHA512 b4218ee3ce799b049789b6210c631998821cc812f0aa28127ee627c9e519bd2cdb5060c3c11bdea396d082652f63bf7072d51638acabcf72ec10d05c4fa6fdbd
SSDEEP 98304:jkFONNRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:jMqR/gmeOqv7Ac9F0kB
TLSH
T1DB26010CFE91E855CD2A7D77CEE601008B7178C1AF21964B32555FEE8F263B259A623C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_kfoyvjaghimeycwnnx credential_access execution sheetrat persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_kfoyvjaghimeycwnnx

103.78.0.204:30033

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/4816-0-0x0000000000890000-0x000000000092A000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\xdwdMicrosoft Excel.exe"	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 2 IoCs

pid	Process
2916	xdwdTeamViewer.exe
1984	xdwdMicrosoft Excel.exe

Loads dropped DLL 47 IoCs

pid	Process
3156	Process not Found
3592	Process not Found
2592	Process not Found
2916	xdwdTeamViewer.exe
3068	Process not Found
4904	Process not Found
2856	Process not Found
1384	Process not Found
1800	Process not Found
608	Process not Found
1836	Process not Found
1984	xdwdMicrosoft Excel.exe
4200	Process not Found
1872	Process not Found
4976	Process not Found
5048	Process not Found
3088	Process not Found
5096	Process not Found
3236	Process not Found
3144	Process not Found
980	Process not Found
4488	Process not Found
1472	Process not Found
3940	Process not Found
1736	Process not Found
2268	Process not Found
3400	Process not Found
4608	Process not Found
4968	Process not Found
3740	Process not Found
4144	Process not Found
672	Process not Found
3928	Process not Found
4348	Process not Found
3040	Process not Found
1052	Process not Found
2800	Process not Found
4164	Process not Found
1752	Process not Found
3192	Process not Found
3228	Process not Found
2204	Process not Found
4168	Process not Found
2516	Process not Found
5092	Process not Found
4488	Process not Found
1472	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\xdwdfghfghfg = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\xdwdTeamViewer.exe"	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xdwdTeamViewer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3192	schtasks.exe
4852	schtasks.exe
4480	schtasks.exe
4936	schtasks.exe
3916	schtasks.exe
2860	schtasks.exe
2252	schtasks.exe
1708	schtasks.exe
1432	schtasks.exe
3184	schtasks.exe
468	schtasks.exe
4384	schtasks.exe
4404	schtasks.exe
4200	schtasks.exe
4016	schtasks.exe
880	schtasks.exe
4580	schtasks.exe
1492	schtasks.exe
4168	schtasks.exe
5036	schtasks.exe
3580	schtasks.exe
4312	schtasks.exe
4568	schtasks.exe
2984	schtasks.exe
2268	schtasks.exe
236	schtasks.exe
4252	schtasks.exe
1836	schtasks.exe
4580	schtasks.exe
4116	schtasks.exe
2488	schtasks.exe
2116	schtasks.exe
1976	schtasks.exe
2288	schtasks.exe
4436	schtasks.exe
4280	schtasks.exe
4980	schtasks.exe
4852	schtasks.exe
4324	schtasks.exe
3564	schtasks.exe
4304	schtasks.exe
1872	schtasks.exe
2412	schtasks.exe
2800	schtasks.exe
1044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe
2916	xdwdTeamViewer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe
Token: SeDebugPrivilege	2916	xdwdTeamViewer.exe
Token: SeDebugPrivilege	1984	xdwdMicrosoft Excel.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3252	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	81
PID 3252 wrote to memory of 4116	3252	CMD.exe	83
PID 4816 wrote to memory of 2564	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	84
PID 2564 wrote to memory of 4852	2564	CMD.exe	86
PID 4816 wrote to memory of 4028	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	87
PID 4028 wrote to memory of 1432	4028	CMD.exe	89
PID 4816 wrote to memory of 2828	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	93
PID 2828 wrote to memory of 2268	2828	CMD.exe	95
PID 4816 wrote to memory of 4648	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	96
PID 4648 wrote to memory of 236	4648	CMD.exe	98
PID 4816 wrote to memory of 4624	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	99
PID 4624 wrote to memory of 2488	4624	CMD.exe	101
PID 4816 wrote to memory of 684	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	102
PID 684 wrote to memory of 3184	684	CMD.exe	104
PID 2916 wrote to memory of 3776	2916	xdwdTeamViewer.exe	105
PID 3776 wrote to memory of 3916	3776	CMD.exe	107
PID 4816 wrote to memory of 928	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	108
PID 928 wrote to memory of 2116	928	CMD.exe	110
PID 4816 wrote to memory of 2076	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	111
PID 2076 wrote to memory of 4252	2076	CMD.exe	113
PID 2916 wrote to memory of 1984	2916	xdwdTeamViewer.exe	114
PID 4816 wrote to memory of 2364	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	115
PID 2364 wrote to memory of 4324	2364	CMD.exe	117
PID 4816 wrote to memory of 4188	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	118
PID 4188 wrote to memory of 2800	4188	CMD.exe	120
PID 4816 wrote to memory of 2728	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	121
PID 2728 wrote to memory of 3564	2728	CMD.exe	123
PID 4816 wrote to memory of 4588	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	124
PID 4588 wrote to memory of 1044	4588	CMD.exe	126
PID 1984 wrote to memory of 760	1984	xdwdMicrosoft Excel.exe	127
PID 760 wrote to memory of 3192	760	CMD.exe	129
PID 4816 wrote to memory of 4076	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	130
PID 4076 wrote to memory of 468	4076	CMD.exe	132
PID 1984 wrote to memory of 3200	1984	xdwdMicrosoft Excel.exe	133
PID 3200 wrote to memory of 1976	3200	CMD.exe	135
PID 4816 wrote to memory of 3240	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	136
PID 3240 wrote to memory of 4168	3240	CMD.exe	138
PID 4816 wrote to memory of 3692	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	139
PID 3692 wrote to memory of 4852	3692	CMD.exe	141
PID 4816 wrote to memory of 4800	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	142
PID 4800 wrote to memory of 4580	4800	CMD.exe	144
PID 4816 wrote to memory of 1432	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	145
PID 1432 wrote to memory of 1492	1432	CMD.exe	147
PID 4816 wrote to memory of 484	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	148
PID 484 wrote to memory of 4304	484	CMD.exe	150
PID 4816 wrote to memory of 5044	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	151
PID 5044 wrote to memory of 2860	5044	CMD.exe	153
PID 4816 wrote to memory of 2884	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	154
PID 2884 wrote to memory of 4480	2884	CMD.exe	156
PID 4816 wrote to memory of 3148	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	157
PID 3148 wrote to memory of 4384	3148	CMD.exe	159
PID 4816 wrote to memory of 236	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	160
PID 236 wrote to memory of 2252	236	CMD.exe	162
PID 4816 wrote to memory of 2392	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	163
PID 2392 wrote to memory of 2288	2392	CMD.exe	165
PID 4816 wrote to memory of 4912	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	166
PID 4912 wrote to memory of 4404	4912	CMD.exe	168
PID 4816 wrote to memory of 1396	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	169
PID 1396 wrote to memory of 5036	1396	CMD.exe	171
PID 4816 wrote to memory of 1004	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	172
PID 1004 wrote to memory of 4436	1004	CMD.exe	174
PID 4816 wrote to memory of 3780	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	175
PID 3780 wrote to memory of 1836	3780	CMD.exe	177
PID 4816 wrote to memory of 3288	4816	xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe	178

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe
"C:\Users\Admin\AppData\Local\Temp\xdacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "granny connect to multiplayer" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "granny connect to multiplayer" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4852
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Dynamics Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdTeamViewer.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Dynamics Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdTeamViewer.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2268
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4852
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4580
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1492
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:484
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4304
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4384
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2288
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4404
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5036
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4436
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1836
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:3288
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:4752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:3416
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4200
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:2776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3580
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:1732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:4692
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4312
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:1260
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4936
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:5056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4016
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4568
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:4852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2412
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:3744
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4580
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:4596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:880
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  PID:3156
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2984

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdTeamViewer.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdTeamViewer.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3916
- C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe
  "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3192
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Money" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwdMicrosoft Excel.exe

Path C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Excel.exe
Size 4.3MB
SHA256 dacd3fca223028403d6b4f2132a2bee8e15d8c8a9d50b5c4b3c05d23644cc944
MD5 7c2805150c8a4d3effc43ccac18048f5
SHA1 d6174c96fec5ae3cd9fecfb2fe9d6e8a2b794b84
SHA512 b4218ee3ce799b049789b6210c631998821cc812f0aa28127ee627c9e519bd2cdb5060c3c11bdea396d082652f63bf7072d51638acabcf72ec10d05c4fa6fdbd
SSDEEP 98304:jkFONNRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:jMqR/gmeOqv7Ac9F0kB
TLSH
T1DB26010CFE91E855CD2A7D77CEE601008B7178C1AF21964B32555FEE8F263B259A623C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 a90e7ba4514145432ef3e9b72db260ca4f21de07dc559e5b19e154214af12afd
MD5 5f874abed49332c40427137cc97043c5
SHA1 f9a8c5eec51d020067c5de9110bd831f4857e45f
SHA512 ad751a3b06ce2f8cb76e7affa0890ed96e6e024ef1d767d487b02d54eef04f1f03e354727f22caee4b8cec904d71681e98e0994c6778491a80462d880ba7b091
SSDEEP 3072:L0i6+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4G2pZpt:L0+yDSvdoRj2Wp
TLSH
T183D35A0772A600BFE1668638C5630A09D777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1984-129-0x000000001BDD0000-0x000000001BE7F000-memory.dmp

Download

memory/1984-139-0x00000000018B0000-0x00000000018BC000-memory.dmp

Download

memory/1984-138-0x000000001BDD0000-0x000000001BE7F000-memory.dmp

Download

memory/1984-130-0x00007FF918850000-0x00007FF918872000-memory.dmp

Download

memory/2916-121-0x000000001B1E0000-0x000000001B28F000-memory.dmp

Download

memory/2916-96-0x00007FF918C80000-0x00007FF918CA2000-memory.dmp

Download

memory/2916-95-0x000000001B1E0000-0x000000001B28F000-memory.dmp

Download

memory/2916-123-0x00007FF918C80000-0x00007FF918CA2000-memory.dmp

Download

memory/2916-122-0x0000000000B10000-0x0000000000B1C000-memory.dmp

Download

memory/2916-46-0x00007FF918C80000-0x00007FF918CA2000-memory.dmp

Download

memory/4816-79-0x000000001BCC0000-0x000000001BCD0000-memory.dmp

Download

memory/4816-0-0x0000000000890000-0x000000000092A000-memory.dmp

Download

memory/4816-37-0x000000001BCC0000-0x000000001BCD0000-memory.dmp

Download

memory/4816-1-0x0000000002A00000-0x0000000002AAF000-memory.dmp

Download

memory/4816-2-0x0000000002AE0000-0x0000000002AEC000-memory.dmp

Download