sheetrat | cb4bea7695ca2be69ce55b581ba5e2a7917aaea3dce7a66c93e83f4c89a541c8

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
122.exe
Size 346KB
Sample260628-deyefsez4s
SHA256 cb4bea7695ca2be69ce55b581ba5e2a7917aaea3dce7a66c93e83f4c89a541c8
MD5 693899ff398c00c7bf0f3a3d230ea0bc
SHA1 4d42e3c5415c3c30ac1612fb3b703bfa8de1a024
SHA512 2cab87eb7c47cf14d09f35d5aaeae19317fe28d9b388374b0cae428dba9f0a64a2f96559eb5c0f376cada15069182bec7f7b53b38920f33e70674179e67c5bd6
SSDEEP 6144:O4fKFnwL14QrM5e9B0e6VlWT8b9S/hIHlqhxzqbcyW:VM389OPVle8E/YlqXFyW
TLSH
T11A74A24CFE91F805CE5A3D77CFE610008B7225C22E219256315A6FFD8B6637698E61BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_hhjmnjytouocaam execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_hhjmnjytouocaam

pornomap-1488.pornomap:1488

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/3712-0-0x0000000000630000-0x000000000068C000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\xdwdBlender.exe"	122.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 2 IoCs

pid	Process
1776	xdwdBlender.exe
5440	xdwdPaint.NET.exe

Loads dropped DLL 50 IoCs

pid	Process
5600	Process not Found
2052	Process not Found
3560	Process not Found
1340	Process not Found
6100	Process not Found
5736	Process not Found
1776	xdwdBlender.exe
5440	xdwdPaint.NET.exe
3884	Process not Found
5000	svchost.exe
1060	Process not Found
3552	Process not Found
4300	Process not Found
1984	Process not Found
5872	Process not Found
2156	Process not Found
5620	Process not Found
4484	Process not Found
2308	Process not Found
4280	Process not Found
5780	Process not Found
4920	Process not Found
1468	Process not Found
572	Process not Found
5712	Process not Found
2364	Process not Found
1800	Process not Found
828	Process not Found
2104	Process not Found
4932	Process not Found
4264	Process not Found
3032	Process not Found
5980	Process not Found
1488	Process not Found
5260	Process not Found
1512	Process not Found
2408	Process not Found
4600	Process not Found
2376	Process not Found
4748	Process not Found
2760	Process not Found
616	Process not Found
2484	Process not Found
3532	Process not Found
3724	Process not Found
3612	Process not Found
5916	Process not Found
4580	Process not Found
2076	Process not Found
2352	Process not Found

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	122.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 47 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3804	schtasks.exe
420	schtasks.exe
888	schtasks.exe
1112	schtasks.exe
4124	schtasks.exe
3612	schtasks.exe
1208	schtasks.exe
824	schtasks.exe
692	schtasks.exe
5360	schtasks.exe
3036	schtasks.exe
3384	schtasks.exe
3520	schtasks.exe
5972	schtasks.exe
5680	schtasks.exe
204	schtasks.exe
6100	schtasks.exe
4640	schtasks.exe
2844	schtasks.exe
4280	schtasks.exe
6052	schtasks.exe
1332	schtasks.exe
468	schtasks.exe
824	schtasks.exe
5992	schtasks.exe
3724	schtasks.exe
5336	schtasks.exe
4124	schtasks.exe
1184	schtasks.exe
1352	schtasks.exe
5364	schtasks.exe
432	schtasks.exe
2352	schtasks.exe
2980	schtasks.exe
2812	schtasks.exe
3760	schtasks.exe
5696	schtasks.exe
2328	schtasks.exe
912	schtasks.exe
5684	schtasks.exe
2764	schtasks.exe
5820	schtasks.exe
5792	schtasks.exe
2956	schtasks.exe
5596	schtasks.exe
1396	schtasks.exe
2900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5000	svchost.exe
5000	svchost.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe
5440	xdwdPaint.NET.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3712	122.exe
Token: SeDebugPrivilege	1776	xdwdBlender.exe
Token: SeDebugPrivilege	5440	xdwdPaint.NET.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 5908	3712	122.exe	90
PID 5908 wrote to memory of 3760	5908	CMD.exe	92
PID 3712 wrote to memory of 3220	3712	122.exe	93
PID 3220 wrote to memory of 1184	3220	CMD.exe	95
PID 3712 wrote to memory of 2224	3712	122.exe	96
PID 2224 wrote to memory of 5972	2224	CMD.exe	98
PID 3712 wrote to memory of 2420	3712	122.exe	101
PID 2420 wrote to memory of 1332	2420	CMD.exe	103
PID 3712 wrote to memory of 264	3712	122.exe	104
PID 264 wrote to memory of 1352	264	CMD.exe	106
PID 3712 wrote to memory of 2804	3712	122.exe	107
PID 2804 wrote to memory of 468	2804	CMD.exe	109
PID 3712 wrote to memory of 1144	3712	122.exe	112
PID 1144 wrote to memory of 824	1144	CMD.exe	114
PID 3712 wrote to memory of 5412	3712	122.exe	116
PID 5412 wrote to memory of 5364	5412	CMD.exe	118
PID 3712 wrote to memory of 1236	3712	122.exe	119
PID 1236 wrote to memory of 4124	1236	CMD.exe	121
PID 3712 wrote to memory of 2796	3712	122.exe	122
PID 2796 wrote to memory of 5992	2796	CMD.exe	124
PID 3712 wrote to memory of 1076	3712	122.exe	125
PID 1076 wrote to memory of 5696	1076	CMD.exe	127
PID 1776 wrote to memory of 5060	1776	xdwdBlender.exe	128
PID 5060 wrote to memory of 1396	5060	CMD.exe	130
PID 5440 wrote to memory of 5436	5440	xdwdPaint.NET.exe	131
PID 5436 wrote to memory of 3520	5436	CMD.exe	133
PID 3712 wrote to memory of 3240	3712	122.exe	134
PID 3240 wrote to memory of 912	3240	CMD.exe	136
PID 1776 wrote to memory of 5884	1776	xdwdBlender.exe	137
PID 5884 wrote to memory of 432	5884	CMD.exe	139
PID 3712 wrote to memory of 4492	3712	122.exe	140
PID 4492 wrote to memory of 5680	4492	CMD.exe	142
PID 3712 wrote to memory of 1376	3712	122.exe	143
PID 1376 wrote to memory of 3724	1376	CMD.exe	145
PID 3712 wrote to memory of 3924	3712	122.exe	146
PID 3924 wrote to memory of 3612	3924	CMD.exe	148
PID 3712 wrote to memory of 4076	3712	122.exe	149
PID 4076 wrote to memory of 2900	4076	CMD.exe	151
PID 3712 wrote to memory of 1980	3712	122.exe	153
PID 1980 wrote to memory of 2352	1980	CMD.exe	155
PID 3712 wrote to memory of 2096	3712	122.exe	156
PID 2096 wrote to memory of 5336	2096	CMD.exe	158
PID 3712 wrote to memory of 2564	3712	122.exe	159
PID 2564 wrote to memory of 2328	2564	CMD.exe	161
PID 3712 wrote to memory of 5956	3712	122.exe	162
PID 5956 wrote to memory of 1208	5956	CMD.exe	164
PID 3712 wrote to memory of 484	3712	122.exe	165
PID 484 wrote to memory of 204	484	CMD.exe	167
PID 3712 wrote to memory of 248	3712	122.exe	168
PID 248 wrote to memory of 2956	248	CMD.exe	170
PID 3712 wrote to memory of 1608	3712	122.exe	171
PID 1608 wrote to memory of 6100	1608	CMD.exe	173
PID 3712 wrote to memory of 5848	3712	122.exe	174
PID 5848 wrote to memory of 5684	5848	CMD.exe	176
PID 3712 wrote to memory of 1856	3712	122.exe	177
PID 1856 wrote to memory of 5596	1856	CMD.exe	179
PID 3712 wrote to memory of 3340	3712	122.exe	180
PID 3340 wrote to memory of 3804	3340	CMD.exe	182
PID 3712 wrote to memory of 4816	3712	122.exe	183
PID 4816 wrote to memory of 824	4816	CMD.exe	185
PID 3712 wrote to memory of 4736	3712	122.exe	186
PID 4736 wrote to memory of 2764	4736	CMD.exe	188
PID 3712 wrote to memory of 1060	3712	122.exe	189
PID 1060 wrote to memory of 4124	1060	CMD.exe	191

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\122.exe
"C:\Users\Admin\AppData\Local\Temp\122.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft PowerPoint Host" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft PowerPoint Host" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Dynamics" /tr "C:\Users\Admin\Videos\xdwdPaint.NET.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Dynamics" /tr "C:\Users\Admin\Videos\xdwdPaint.NET.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:912
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5336
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2328
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:484
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:204
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2956
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5684
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3804
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2764
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:3552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:5080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:420
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:4840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:2568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:4792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:2344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3036
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:4488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3384
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:5496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4640
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:3088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1112
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:1604
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:4136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5820
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:2640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6052
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:5300
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:5044
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  PID:2388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5792

C:\Users\Admin\AppData\Roaming\xdwdBlender.exe
C:\Users\Admin\AppData\Roaming\xdwdBlender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\System32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1396
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Windows\System32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:432

C:\Users\Admin\Videos\xdwdPaint.NET.exe
C:\Users\Admin\Videos\xdwdPaint.NET.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Windows\System32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3712-0-0x0000000000630000-0x000000000068C000-memory.dmp

Download

memory/3712-1-0x00007FFA2DA3F000-0x00007FFA2DA40000-memory.dmp

Download

memory/3712-2-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3712-3-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3712-4-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3712-5-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3712-6-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3712-35-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3712-123-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download