lumma | aa9f6621da7e8adbda9c3c941031bafbb71591e76429871f121cb3f00b7219b1

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_84f7b78c0b8f7d908d86f79dbefb1440_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.6MB
Sample260801-fps9laybrg
SHA256 aa9f6621da7e8adbda9c3c941031bafbb71591e76429871f121cb3f00b7219b1
MD5 84f7b78c0b8f7d908d86f79dbefb1440
SHA1 71af317f5d6850f3c96917929359837351c238f9
SHA512 ce212114c7c42cd7a302dbd445a65ba6cd864d90c8e0c919beefffe71355504fc9198fb710989d608decc7fbb37435543a47e7181c558d36c1374ce5b6315247
SSDEEP 49152:71eRAjcbeBPHHY3nttCT8HSYLDlexvWlki:71m0kmRYLDlex
TLSH
T12E752392B9D1C076D8671A7199F5EFB4992DFC214F6018DB63C8073A8F319C09B24E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_bmrsbggldtgly discovery execution lumma sheetrat persistence privilege_escalation stealer trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_bmrsbggldtgly

Attributes

ddr
https://pastebin.com/raw/SaWpVqSz

Extracted

Family

lumma

https://stochalyqp.xyz/alfp
https://narrathfpt.top/tekq
https://escczlv.top/bufi
https://localixbiw.top/zlpa
https://korxddl.top/qidz
https://diecam.top/laur
https://citellcagt.top/gjtu
https://peppinqikp.xyz/xaow

Attributes

build_id
5bd78f1044ce509f086494549ae1b242

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x000a000000011390-5.dat	family_sheetrat_v4
behavioral2/memory/4728-15-0x0000000000380000-0x00000000003D6000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000011390-5.dat	Sheetrat_v5
behavioral2/memory/4728-15-0x0000000000380000-0x00000000003D6000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\xdwdZoom.exe"	dTHl7u0YzK.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.exe	YgMhGm95x9.exe

Executes dropped EXE 7 IoCs

pid	Process
4728	dTHl7u0YzK.exe
5056	auPDLT1XFa.exe
3176	YgMhGm95x9.exe
3168	QAmWZI8hsB.exe
5552	xdwdMicrosoft Edge DevTools.exe
3888	xdwdZoom.exe
5848	xdwdZoom.exe

Loads dropped DLL 53 IoCs

pid	Process
1388	Process not Found
4744	Process not Found
1864	Process not Found
1892	Process not Found
1924	Process not Found
5552	xdwdMicrosoft Edge DevTools.exe
3888	xdwdZoom.exe
4588	Process not Found
2272	Process not Found
476	Process not Found
4732	Process not Found
2396	Process not Found
3912	Process not Found
5876	Process not Found
6052	Process not Found
5048	Process not Found
5724	Process not Found
5848	xdwdZoom.exe
4104	Process not Found
1984	Process not Found
5584	Process not Found
4500	Process not Found
5144	Process not Found
1236	Process not Found
3684	Process not Found
4640	Process not Found
2584	Process not Found
5076	Process not Found
5548	Process not Found
1152	Process not Found
4428	Process not Found
1440	Process not Found
1336	Process not Found
3316	Process not Found
1964	Process not Found
2664	Process not Found
4744	Process not Found
2812	Process not Found
3560	Process not Found
1532	Process not Found
1096	Process not Found
5540	Process not Found
636	Process not Found
1344	Process not Found
4376	Process not Found
2668	Process not Found
2588	Process not Found
5076	Process not Found
5760	Process not Found
4480	Process not Found
4824	Process not Found
908	Process not Found
4220	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\xdwdfghfghfg978967 = "C:\\Users\\Admin\\AppData\\Roaming\\xdwdMicrosoft Edge DevTools.exe"	dTHl7u0YzK.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
14	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3168 set thread context of 4756	3168	QAmWZI8hsB.exe	95

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	dTHl7u0YzK.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 49 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3164	CMD.exe
3496	CMD.exe
5952	CMD.exe
4392	CMD.exe
4552	CMD.exe
3028	CMD.exe
3524	CMD.exe
4944	CMD.exe
3880	CMD.exe
4920	CMD.exe
2252	CMD.exe
4588	CMD.exe
3472	CMD.exe
2988	CMD.exe
4496	CMD.exe
4320	CMD.exe
4888	CMD.exe
5932	CMD.exe
5168	CMD.exe
4688	CMD.exe
624	CMD.exe
4652	CMD.exe
3532	CMD.exe
1388	CMD.exe
5564	CMD.exe
3828	CMD.exe
832	CMD.exe
5116	CMD.exe
4848	CMD.exe
3424	CMD.exe
4576	CMD.exe
2772	CMD.exe
1648	CMD.exe
1236	CMD.exe
2724	CMD.exe
2392	CMD.exe
5536	CMD.exe
4420	CMD.exe
5452	CMD.exe
2804	CMD.exe
4548	CMD.exe
1136	CMD.exe
1436	CMD.exe
1656	CMD.exe
1064	CMD.exe
3928	CMD.exe
1440	CMD.exe
2708	CMD.exe
3924	CMD.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	auPDLT1XFa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_84f7b78c0b8f7d908d86f79dbefb1440_amadey_elex_luca-stealer_lynx_njrat.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 49 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5692	schtasks.exe
4248	schtasks.exe
2880	schtasks.exe
2072	schtasks.exe
5104	schtasks.exe
1468	schtasks.exe
2064	schtasks.exe
3112	schtasks.exe
1208	schtasks.exe
4348	schtasks.exe
580	schtasks.exe
5112	schtasks.exe
4512	schtasks.exe
1384	schtasks.exe
4748	schtasks.exe
4888	schtasks.exe
1900	schtasks.exe
4616	schtasks.exe
5876	schtasks.exe
2960	schtasks.exe
5100	schtasks.exe
4168	schtasks.exe
5528	schtasks.exe
4344	schtasks.exe
4484	schtasks.exe
4128	schtasks.exe
5444	schtasks.exe
3004	schtasks.exe
4820	schtasks.exe
3336	schtasks.exe
1168	schtasks.exe
4432	schtasks.exe
5528	schtasks.exe
1512	schtasks.exe
3272	schtasks.exe
1512	schtasks.exe
864	schtasks.exe
3332	schtasks.exe
4480	schtasks.exe
3372	schtasks.exe
3444	schtasks.exe
2632	schtasks.exe
2400	schtasks.exe
1900	schtasks.exe
4928	schtasks.exe
4496	schtasks.exe
4276	schtasks.exe
3416	schtasks.exe
4276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe
5552	xdwdMicrosoft Edge DevTools.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4728	dTHl7u0YzK.exe
Token: SeDebugPrivilege	5552	xdwdMicrosoft Edge DevTools.exe
Token: SeDebugPrivilege	3888	xdwdZoom.exe
Token: SeDebugPrivilege	5848	xdwdZoom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4728	2420	2026-08-01_84f7b78c0b8f7d908d86f79dbefb1440_amadey_elex_luca-stealer_lynx_njrat.exe	89
PID 2420 wrote to memory of 5056	2420	2026-08-01_84f7b78c0b8f7d908d86f79dbefb1440_amadey_elex_luca-stealer_lynx_njrat.exe	90
PID 5056 wrote to memory of 3176	5056	auPDLT1XFa.exe	92
PID 5056 wrote to memory of 3168	5056	auPDLT1XFa.exe	93
PID 3168 wrote to memory of 4756	3168	QAmWZI8hsB.exe	95
PID 3168 wrote to memory of 4756	3168	QAmWZI8hsB.exe	95
PID 3168 wrote to memory of 4756	3168	QAmWZI8hsB.exe	95
PID 3168 wrote to memory of 4756	3168	QAmWZI8hsB.exe	95
PID 3168 wrote to memory of 4756	3168	QAmWZI8hsB.exe	95
PID 3168 wrote to memory of 4756	3168	QAmWZI8hsB.exe	95
PID 4728 wrote to memory of 2708	4728	dTHl7u0YzK.exe	96
PID 2708 wrote to memory of 3332	2708	CMD.exe	98
PID 4728 wrote to memory of 3028	4728	dTHl7u0YzK.exe	99
PID 3028 wrote to memory of 1168	3028	CMD.exe	101
PID 4728 wrote to memory of 3424	4728	dTHl7u0YzK.exe	102
PID 3424 wrote to memory of 1900	3424	CMD.exe	104
PID 4728 wrote to memory of 4576	4728	dTHl7u0YzK.exe	108
PID 4576 wrote to memory of 4344	4576	CMD.exe	110
PID 4728 wrote to memory of 2252	4728	dTHl7u0YzK.exe	113
PID 2252 wrote to memory of 4928	2252	CMD.exe	115
PID 4728 wrote to memory of 2772	4728	dTHl7u0YzK.exe	116
PID 2772 wrote to memory of 4348	2772	CMD.exe	118
PID 4728 wrote to memory of 2804	4728	dTHl7u0YzK.exe	120
PID 2804 wrote to memory of 5692	2804	CMD.exe	122
PID 4728 wrote to memory of 3524	4728	dTHl7u0YzK.exe	123
PID 3524 wrote to memory of 4480	3524	CMD.exe	125
PID 3888 wrote to memory of 3532	3888	xdwdZoom.exe	126
PID 3532 wrote to memory of 4432	3532	CMD.exe	128
PID 4728 wrote to memory of 4548	4728	dTHl7u0YzK.exe	129
PID 4548 wrote to memory of 3372	4548	CMD.exe	131
PID 3888 wrote to memory of 2392	3888	xdwdZoom.exe	132
PID 5552 wrote to memory of 3924	5552	xdwdMicrosoft Edge DevTools.exe	134
PID 2392 wrote to memory of 3444	2392	CMD.exe	136
PID 3924 wrote to memory of 4496	3924	CMD.exe	137
PID 4728 wrote to memory of 3164	4728	dTHl7u0YzK.exe	138
PID 3164 wrote to memory of 2632	3164	CMD.exe	140
PID 4728 wrote to memory of 5536	4728	dTHl7u0YzK.exe	141
PID 5536 wrote to memory of 2400	5536	CMD.exe	143
PID 5552 wrote to memory of 5848	5552	xdwdMicrosoft Edge DevTools.exe	144
PID 4728 wrote to memory of 5168	4728	dTHl7u0YzK.exe	145
PID 5168 wrote to memory of 4484	5168	CMD.exe	147
PID 4728 wrote to memory of 1136	4728	dTHl7u0YzK.exe	148
PID 1136 wrote to memory of 5528	1136	CMD.exe	150
PID 4728 wrote to memory of 3496	4728	dTHl7u0YzK.exe	151
PID 3496 wrote to memory of 4888	3496	CMD.exe	153
PID 4728 wrote to memory of 4944	4728	dTHl7u0YzK.exe	154
PID 4944 wrote to memory of 1468	4944	CMD.exe	156
PID 5848 wrote to memory of 1388	5848	xdwdZoom.exe	157
PID 1388 wrote to memory of 4248	1388	CMD.exe	159
PID 4728 wrote to memory of 4688	4728	dTHl7u0YzK.exe	160
PID 4688 wrote to memory of 1900	4688	CMD.exe	162
PID 5848 wrote to memory of 4420	5848	xdwdZoom.exe	163
PID 4420 wrote to memory of 4616	4420	CMD.exe	165
PID 4728 wrote to memory of 5564	4728	dTHl7u0YzK.exe	166
PID 5564 wrote to memory of 2064	5564	CMD.exe	168
PID 4728 wrote to memory of 624	4728	dTHl7u0YzK.exe	169
PID 624 wrote to memory of 1512	624	CMD.exe	171
PID 4728 wrote to memory of 4588	4728	dTHl7u0YzK.exe	172
PID 4588 wrote to memory of 580	4588	CMD.exe	174
PID 4728 wrote to memory of 3472	4728	dTHl7u0YzK.exe	175
PID 3472 wrote to memory of 2880	3472	CMD.exe	177
PID 4728 wrote to memory of 1436	4728	dTHl7u0YzK.exe	178
PID 1436 wrote to memory of 4128	1436	CMD.exe	180
PID 4728 wrote to memory of 3828	4728	dTHl7u0YzK.exe	181

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-01_84f7b78c0b8f7d908d86f79dbefb1440_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_84f7b78c0b8f7d908d86f79dbefb1440_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Roaming\dTHl7u0YzK.exe
  "C:\Users\Admin\AppData\Roaming\dTHl7u0YzK.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Programm" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Programm" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3332
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1168
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Eclipse" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Edge DevTools.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "Eclipse" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Edge DevTools.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1900
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4344
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4928
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4348
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5692
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4480
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3372
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2632
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5536
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2400
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5168
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4484
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1136
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5528
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4888
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1468
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1900
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5564
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2064
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:624
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1512
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:580
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2880
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4128
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3828
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5444
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3880
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4276
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2988
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5112
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4496
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5876
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1656
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2960
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:832
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5100
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1648
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3112
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5952
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4168
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4320
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1208
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5116
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5528
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4888
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3416
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4392
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4512
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5932
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3272
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1236
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1384
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4652
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2072
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4848
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1512
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1064
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:864
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2724
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3004
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3928
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5104
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5452
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4820
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4920
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4276
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1440
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4748
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4552
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3336
- C:\Users\Admin\AppData\Roaming\auPDLT1XFa.exe
  "C:\Users\Admin\AppData\Roaming\auPDLT1XFa.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Users\Admin\AppData\Roaming\YgMhGm95x9.exe
    "C:\Users\Admin\AppData\Roaming\YgMhGm95x9.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    PID:3176
- - C:\Users\Admin\AppData\Roaming\QAmWZI8hsB.exe
    "C:\Users\Admin\AppData\Roaming\QAmWZI8hsB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4756

C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Edge DevTools.exe
"C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Edge DevTools.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4496
- C:\Users\Admin\AppData\Local\xdwdZoom.exe
  "C:\Users\Admin\AppData\Local\xdwdZoom.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4248
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4616

C:\Users\Admin\AppData\Local\xdwdZoom.exe
C:\Users\Admin\AppData\Local\xdwdZoom.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QAmWZI8hsB.exe

Path C:\Users\Admin\AppData\Roaming\QAmWZI8hsB.exe
Size 936KB
SHA256 fdd64d8a52aeb1ca21ab4863fc5dba75bda229dd3bf1638dac9b300537724793
MD5 aa4628ca9b5fc6f7209ceac1462b4451
SHA1 ca9988d26b7775bcd668f4c495df7757922079d8
SHA512 3737ee40a5d98a1f8fefa155f39fb813b52ca06777e173f5556f33fe33402a23c51a0b578b88877bc3a56a1c4a17c8f677abc7f4318ba03a7abed523fef59f9c
SSDEEP 24576:ZeFOyibRzGhjfuYKV4NQF1x6g+NDoOZMR4XRvoVjW6spjTSQ6MDl:ZzbRzGhjg6g+NLM0GjW6stTN6M
TLSH
T14615AE28969192D9FC3500B980B156A578727A33C32C3FFB82A4F3739E0B6C58F56759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YgMhGm95x9.exe

Path C:\Users\Admin\AppData\Roaming\YgMhGm95x9.exe
Size 11KB
SHA256 b3345ab02ca9c19e600350c4852499b433f1da3699f1793b89ac8ded09f053ab
MD5 287ab028f1ceab5f2e96de2eead2debc
SHA1 1aefa06d5273076127f5df221dc68f7b7c614793
SHA512 2a784aa8b3832bfc4ce0d2f1a4ca472e3002dd45700ae855bd440c5430f4f4003bc5377344461be72fd9302c350357b5ed1b1f3097394d45627f5cea8caf59af
SSDEEP 192:M9bXfZ/HsmmPlAj2F7R0UZm7NVA6p3+PHK2d2yX5Xz6MWD9ep:07fZ/HxmPlAjEqUZ+m6Z+Pq23Xd6MWp
TLSH
T1EA32C700E7E29067E87E997859B76A045BB4B7165C05CF7F2AC8518B08327A489B3E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auPDLT1XFa.exe

Path C:\Users\Admin\AppData\Roaming\auPDLT1XFa.exe
Size 1.1MB
SHA256 3f8e54b3c1b5de6a763ebc0606286ad198ee7ad19f9af43fe39be77e99acc625
MD5 d2d6f9683201c3f27420f1104e88bf20
SHA1 887d3a9dd2540b694ce5793a6a6a00aca07977d7
SHA512 f27b781043d1c9124a05f33f65cdfaffd952f9e2f877b6e4d1832f614f82ff3e3e156178983cd4524c25f4a63e7e4ef3061712d6f75f031c93c4810b79e7ae4a
SSDEEP 24576:Daa1UjU3qqATpNxwq8jfN6NTN3puIqJ64NNliJPYGB12ANb0Vv+h:11eU3qFTpgq8TN+TXiJ64N3of2ANbMo
TLSH
T1A8451221B9C0C133D867153159F1DBF94A3DF8600F20AADBA7C81B7B9E206D19B3566B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dTHl7u0YzK.exe

Path C:\Users\Admin\AppData\Roaming\dTHl7u0YzK.exe
Size 327KB
SHA256 a9696560dc2c7e6e43f216df2a877b1577dff440c856369cc74d266d68db52f8
MD5 41c99ed19f6527346aaf5726736f73eb
SHA1 0e487a7e062703f5cc18caff0c4a37111f9ea41d
SHA512 b7d840d1af44c72bc3d36fcc17f7776a7b0698cc63d64948eefee6d5dc92ee34b325e5285484d7721d6096ab9dcaf8f66e369388b4756614d6ffb4a6aa0b01a3
SSDEEP 6144:O8l4CGC0D3rHlTe6VlWT8b9kMUZXbySbarFijwx1:OhCI1PVle8D4Ehijwx1
TLSH
T1EE64D51CFE91E805DD6A3D77CBF610148B7126C22F219243324A6FFC8B6637659A61BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3176-40-0x000002526D810000-0x000002526D818000-memory.dmp

Download

memory/4728-16-0x00007FFCF55BF000-0x00007FFCF55C0000-memory.dmp

Download

memory/4728-24-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4728-23-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4728-21-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4728-18-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4728-47-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4728-15-0x0000000000380000-0x00000000003D6000-memory.dmp

Download

memory/4756-45-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/4756-46-0x0000000000400000-0x0000000000463000-memory.dmp

Download