sheetrat | 58d04076178ebe27c623e94c5a4f4abc8220298d81a5567d1932077d2f09104a

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 563KB
Sample260629-vq2ppaav3w
SHA256 58d04076178ebe27c623e94c5a4f4abc8220298d81a5567d1932077d2f09104a
MD5 ef8023a93b62b21a473dc5ca32239d2d
SHA1 6fc9666411c5b78bdc4651709ddcc16f36006b81
SHA512 27182c4556fa5f1fd0302d69a3409f3b07060d2c4bc66cb849c84a5b5865221be91d7c0aca96a2cc86bc6e7dbca168e2febe06247f4dd6d97507459852fcbc3b
SSDEEP 12288:ojZ/BsJRS1dZdiBBPVle8N3gbxgagpFf:ojZXPZdiB1gbC
TLSH
T1C5C4B21CFE91E806CD1A3EB3CFEA14049B7124C1AE2192463159AFFD87653B258E767C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_zibkixdoirzepayu execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Campaign

Sheet_zibkixdoirzepayu

portbuddy.dev:42628

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/1668-0-0x0000000000A80000-0x0000000000B12000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\Music\\Autodesk Maya Host.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 2 IoCs

pid	Process
5568	Inkscape.exe
1288	Autodesk Maya Host.exe

Loads dropped DLL 53 IoCs

pid	Process
4588	Process not Found
4504	Process not Found
6008	Process not Found
6612	Process not Found
2124	Process not Found
6752	WmiApSrv.exe
6624	Process not Found
3080	Process not Found
6216	Process not Found
5568	Inkscape.exe
6300	Process not Found
4176	Process not Found
480	Process not Found
6236	Process not Found
2056	Process not Found
1992	Process not Found
6864	Process not Found
4976	Process not Found
2336	Process not Found
2840	Process not Found
1288	Autodesk Maya Host.exe
3644	Process not Found
1048	Process not Found
2852	Process not Found
2420	Process not Found
1408	Process not Found
6000	Process not Found
1552	Process not Found
6428	Process not Found
6064	Process not Found
5380	Process not Found
4396	Process not Found
5524	Process not Found
3844	Process not Found
2316	Process not Found
5636	Process not Found
1812	Process not Found
1140	Process not Found
4440	Process not Found
3372	Process not Found
4468	Process not Found
1092	Process not Found
4660	Process not Found
6848	Process not Found
6816	Process not Found
2104	Process not Found
6636	Process not Found
3364	Process not Found
3696	Process not Found
3076	Process not Found
424	Process not Found
6472	Process not Found
6844	Process not Found

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
7	api.ipify.org
9	api.ipify.org
1	api.ipify.org

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	Inkscape.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4280	schtasks.exe
2120	schtasks.exe
2176	schtasks.exe
1068	schtasks.exe
4780	schtasks.exe
5104	schtasks.exe
6480	schtasks.exe
4600	schtasks.exe
3600	schtasks.exe
4844	schtasks.exe
6884	schtasks.exe
4184	schtasks.exe
5812	schtasks.exe
2220	schtasks.exe
5156	schtasks.exe
5200	schtasks.exe
6680	schtasks.exe
6876	schtasks.exe
1888	schtasks.exe
5416	schtasks.exe
4932	schtasks.exe
2856	schtasks.exe
1100	schtasks.exe
6368	schtasks.exe
5920	schtasks.exe
3384	schtasks.exe
6696	schtasks.exe
2208	schtasks.exe
784	schtasks.exe
6176	schtasks.exe
2208	schtasks.exe
5008	schtasks.exe
4528	schtasks.exe
3156	schtasks.exe
4156	schtasks.exe
2204	schtasks.exe
3400	schtasks.exe
2412	schtasks.exe
4776	schtasks.exe
1700	schtasks.exe
1776	schtasks.exe
4568	schtasks.exe
7072	schtasks.exe
364	schtasks.exe
5696	schtasks.exe
2668	schtasks.exe
6368	schtasks.exe
6580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
1668	Client.exe
6752	WmiApSrv.exe
6752	WmiApSrv.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
5568	Inkscape.exe
1288	Autodesk Maya Host.exe
1288	Autodesk Maya Host.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	Client.exe
Token: SeDebugPrivilege	5568	Inkscape.exe
Token: SeDebugPrivilege	1288	Autodesk Maya Host.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 6968	1668	Client.exe	89
PID 6968 wrote to memory of 5812	6968	CMD.exe	91
PID 1668 wrote to memory of 6220	1668	Client.exe	92
PID 6220 wrote to memory of 2412	6220	CMD.exe	94
PID 1668 wrote to memory of 6600	1668	Client.exe	95
PID 6600 wrote to memory of 6368	6600	CMD.exe	97
PID 1668 wrote to memory of 3948	1668	Client.exe	101
PID 3948 wrote to memory of 2220	3948	CMD.exe	103
PID 1668 wrote to memory of 5456	1668	Client.exe	106
PID 5456 wrote to memory of 4776	5456	CMD.exe	108
PID 1668 wrote to memory of 4696	1668	Client.exe	109
PID 4696 wrote to memory of 4280	4696	CMD.exe	111
PID 1668 wrote to memory of 6648	1668	Client.exe	113
PID 6648 wrote to memory of 7072	6648	CMD.exe	115
PID 1668 wrote to memory of 6148	1668	Client.exe	116
PID 6148 wrote to memory of 1888	6148	CMD.exe	118
PID 1668 wrote to memory of 5884	1668	Client.exe	119
PID 5884 wrote to memory of 2208	5884	CMD.exe	121
PID 1668 wrote to memory of 5020	1668	Client.exe	122
PID 5020 wrote to memory of 5156	5020	CMD.exe	124
PID 1668 wrote to memory of 5956	1668	Client.exe	125
PID 5956 wrote to memory of 364	5956	CMD.exe	127
PID 5568 wrote to memory of 2552	5568	Inkscape.exe	128
PID 2552 wrote to memory of 2120	2552	CMD.exe	130
PID 1668 wrote to memory of 2608	1668	Client.exe	131
PID 2608 wrote to memory of 4184	2608	CMD.exe	133
PID 1668 wrote to memory of 4072	1668	Client.exe	134
PID 4072 wrote to memory of 5008	4072	CMD.exe	136
PID 1668 wrote to memory of 1268	1668	Client.exe	137
PID 1268 wrote to memory of 5416	1268	CMD.exe	139
PID 1668 wrote to memory of 1672	1668	Client.exe	140
PID 1672 wrote to memory of 2176	1672	CMD.exe	142
PID 5568 wrote to memory of 1288	5568	Inkscape.exe	143
PID 1668 wrote to memory of 6168	1668	Client.exe	144
PID 6168 wrote to memory of 4528	6168	CMD.exe	146
PID 1668 wrote to memory of 6944	1668	Client.exe	147
PID 6944 wrote to memory of 5200	6944	CMD.exe	149
PID 1668 wrote to memory of 4936	1668	Client.exe	150
PID 4936 wrote to memory of 3156	4936	CMD.exe	152
PID 1668 wrote to memory of 6364	1668	Client.exe	153
PID 6364 wrote to memory of 1700	6364	CMD.exe	155
PID 1668 wrote to memory of 6240	1668	Client.exe	156
PID 6240 wrote to memory of 4932	6240	CMD.exe	158
PID 1288 wrote to memory of 5668	1288	Autodesk Maya Host.exe	159
PID 5668 wrote to memory of 6884	5668	CMD.exe	161
PID 1668 wrote to memory of 7108	1668	Client.exe	162
PID 7108 wrote to memory of 3400	7108	CMD.exe	164
PID 1288 wrote to memory of 3132	1288	Autodesk Maya Host.exe	165
PID 3132 wrote to memory of 1068	3132	CMD.exe	167
PID 1668 wrote to memory of 6024	1668	Client.exe	168
PID 6024 wrote to memory of 5920	6024	CMD.exe	170
PID 1668 wrote to memory of 5872	1668	Client.exe	171
PID 1668 wrote to memory of 6264	1668	Client.exe	174
PID 6264 wrote to memory of 3384	6264	CMD.exe	176
PID 1668 wrote to memory of 6152	1668	Client.exe	177
PID 6152 wrote to memory of 5696	6152	CMD.exe	179
PID 1668 wrote to memory of 5528	1668	Client.exe	180
PID 5528 wrote to memory of 6696	5528	CMD.exe	182
PID 1668 wrote to memory of 3816	1668	Client.exe	183
PID 3816 wrote to memory of 4156	3816	CMD.exe	185
PID 1668 wrote to memory of 6828	1668	Client.exe	186
PID 6828 wrote to memory of 2668	6828	CMD.exe	188
PID 1668 wrote to memory of 5664	1668	Client.exe	189
PID 5664 wrote to memory of 1776	5664	CMD.exe	191

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Corel VideoStudio Upgrade" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6968
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Corel VideoStudio Upgrade" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6220
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2412
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Public\Documents\Inkscape.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6600
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Public\Documents\Inkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6368
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6648
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7072
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6148
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5416
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2176
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6168
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6944
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5200
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1700
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6240
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3400
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5920
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:5872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2856
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3384
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6152
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2668
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:5360
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4568
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:1988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4780
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:6584
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5104
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:3080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6368
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4908
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2204
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:7072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2064
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6876
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:1828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6580
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2948
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:5428
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:784
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:6396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6176

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:6752

C:\Users\Public\Documents\Inkscape.exe
C:\Users\Public\Documents\Inkscape.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5568
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\System32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2120
- C:\Users\Admin\Music\Autodesk Maya Host.exe
  "C:\Users\Admin\Music\Autodesk Maya Host.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5668
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6884
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "WPS Office" /tr "C:\Users\Admin\Music\Autodesk Maya Host.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1668-0-0x0000000000A80000-0x0000000000B12000-memory.dmp

Download

memory/1668-1-0x00007FFFE94DF000-0x00007FFFE94E0000-memory.dmp

Download

memory/1668-2-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/1668-3-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/1668-4-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/1668-5-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download

memory/1668-6-0x00007FFFE9350000-0x00007FFFE9CF4000-memory.dmp

Download