sheetrat | 06357c44f52d222e000677990314c4a89aee7001b86402d96a58b2081b3a9b1b

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
проверка.exe
Size 121KB
Sample260806-a8hdjsvyas
SHA256 06357c44f52d222e000677990314c4a89aee7001b86402d96a58b2081b3a9b1b
MD5 1026f25a673719cee828c7ec9f1a223a
SHA1 ffa3370b6fdaebefd46b610379c4ee29e4fc1d45
SHA512 ab39d9ee0fe428d2a81fbcd9ab9b3ef4b98eb911bea1d3b0736198080061635fe075ec81edf4bb9e07d14e23154f85606047d95c6352fbe2ea337e273f88f1b5
SSDEEP 768:rFk0yK0+zke2wBuX2/Igrgafi54EbXBvnsf6HObdi0wDjm+LaYKumIlAp2SbcY89:ZHyK0g2wBuXRqHCjObUnDa+LBKj0fZ
TLSH
T1F3C3D3447384D911D4AD1EB48E42F3C98379AE076D12E30B3D8AB39E2F762C5D616ED2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

gay12311 discovery execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

gay12311

dre1zid-64501.portmap.host:64501

Mutex

Attributes

anti_virtual
false
certificate
nk2aeoioii7gl4nzez5ydgw1h65sn
exclusion_wd
true
hidden_file
true
install
true
install_watch_dog
true
key
yby6bqqlmxzk009zo1mr3lvi9aa9
path_client
%Cookies%\WindowsHeath.exe
path_watch_dog
%Templates%\svchost.exe
pump
false
rootkit
false
task_client
svchost.exe
use_install_admin
true
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/1052-0-0x00000198B0D90000-0x00000198B0DB4000-memory.dmp	family_sheetrat_v1
behavioral2/files/0x0005000000016b3f-14.dat	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\WindowsHeath.exe"	проверка.exe

Executes dropped EXE 4 IoCs

pid	Process
2376	WindowsHeath.exe
2936	WindowsHeath.exe
4532	WindowsHeath.exe
2760	WindowsHeath.exe

Looks up external IP address via web service 1 TTPs 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com
7	icanhazip.com
9	api.ipify.org
12	icanhazip.com
17	icanhazip.com
19	api.ipify.org
1	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 32 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3348	cmd.exe
1504	cmd.exe
4464	cmd.exe
3652	cmd.exe
4352	cmd.exe
4304	cmd.exe
3836	cmd.exe
3988	cmd.exe
4484	cmd.exe
3300	cmd.exe
5344	cmd.exe
5200	cmd.exe
4296	cmd.exe
4788	cmd.exe
1704	cmd.exe
4732	cmd.exe
4980	cmd.exe
4444	cmd.exe
2204	cmd.exe
2380	cmd.exe
4324	cmd.exe
708	cmd.exe
5064	cmd.exe
1332	cmd.exe
3896	cmd.exe
2008	cmd.exe
672	cmd.exe
5896	cmd.exe
3452	cmd.exe
2332	cmd.exe
5992	cmd.exe
4508	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 32 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4732	schtasks.exe
4260	schtasks.exe
4984	schtasks.exe
4584	schtasks.exe
5232	schtasks.exe
1064	schtasks.exe
4908	schtasks.exe
5060	schtasks.exe
6064	schtasks.exe
5728	schtasks.exe
1972	schtasks.exe
2084	schtasks.exe
4320	schtasks.exe
4976	schtasks.exe
3544	schtasks.exe
2536	schtasks.exe
5520	schtasks.exe
4848	schtasks.exe
3768	schtasks.exe
4852	schtasks.exe
2912	schtasks.exe
3020	schtasks.exe
6028	schtasks.exe
244	schtasks.exe
3376	schtasks.exe
4552	schtasks.exe
1196	schtasks.exe
3308	schtasks.exe
4284	schtasks.exe
4800	schtasks.exe
1812	schtasks.exe
1696	schtasks.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	проверка.exe
Token: SeDebugPrivilege	2936	WindowsHeath.exe
Token: SeDebugPrivilege	2376	WindowsHeath.exe
Token: SeIncBasePriorityPrivilege	2376	WindowsHeath.exe
Token: SeDebugPrivilege	4532	WindowsHeath.exe
Token: SeDebugPrivilege	2760	WindowsHeath.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 3552	1052	проверка.exe	91
PID 1052 wrote to memory of 4484	1052	проверка.exe	92
PID 4484 wrote to memory of 4800	4484	cmd.exe	95
PID 1052 wrote to memory of 4980	1052	проверка.exe	96
PID 4980 wrote to memory of 1972	4980	cmd.exe	98
PID 1052 wrote to memory of 2936	1052	проверка.exe	101
PID 2376 wrote to memory of 1504	2376	WindowsHeath.exe	102
PID 1504 wrote to memory of 1812	1504	cmd.exe	104
PID 2936 wrote to memory of 4444	2936	WindowsHeath.exe	105
PID 4444 wrote to memory of 4848	4444	cmd.exe	107
PID 2376 wrote to memory of 4464	2376	WindowsHeath.exe	108
PID 4464 wrote to memory of 1196	4464	cmd.exe	110
PID 2376 wrote to memory of 708	2376	WindowsHeath.exe	111
PID 708 wrote to memory of 1696	708	cmd.exe	113
PID 2376 wrote to memory of 672	2376	WindowsHeath.exe	115
PID 672 wrote to memory of 4732	672	cmd.exe	117
PID 2376 wrote to memory of 3836	2376	WindowsHeath.exe	118
PID 3836 wrote to memory of 3768	3836	cmd.exe	120
PID 2376 wrote to memory of 5896	2376	WindowsHeath.exe	121
PID 5896 wrote to memory of 4260	5896	cmd.exe	123
PID 2376 wrote to memory of 3300	2376	WindowsHeath.exe	125
PID 3300 wrote to memory of 4852	3300	cmd.exe	127
PID 2376 wrote to memory of 2204	2376	WindowsHeath.exe	128
PID 2204 wrote to memory of 2084	2204	cmd.exe	130
PID 4532 wrote to memory of 2380	4532	WindowsHeath.exe	131
PID 2380 wrote to memory of 4984	2380	cmd.exe	133
PID 2376 wrote to memory of 5344	2376	WindowsHeath.exe	134
PID 5344 wrote to memory of 4584	5344	cmd.exe	136
PID 2376 wrote to memory of 5064	2376	WindowsHeath.exe	137
PID 5064 wrote to memory of 4908	5064	cmd.exe	139
PID 2376 wrote to memory of 1332	2376	WindowsHeath.exe	140
PID 1332 wrote to memory of 5060	1332	cmd.exe	142
PID 2376 wrote to memory of 5200	2376	WindowsHeath.exe	143
PID 5200 wrote to memory of 244	5200	cmd.exe	145
PID 2376 wrote to memory of 3452	2376	WindowsHeath.exe	146
PID 3452 wrote to memory of 3376	3452	cmd.exe	148
PID 2376 wrote to memory of 4296	2376	WindowsHeath.exe	149
PID 4296 wrote to memory of 3308	4296	cmd.exe	151
PID 2376 wrote to memory of 3896	2376	WindowsHeath.exe	152
PID 3896 wrote to memory of 6064	3896	cmd.exe	154
PID 2376 wrote to memory of 4788	2376	WindowsHeath.exe	155
PID 4788 wrote to memory of 2912	4788	cmd.exe	157
PID 2376 wrote to memory of 1704	2376	WindowsHeath.exe	158
PID 1704 wrote to memory of 4320	1704	cmd.exe	160
PID 2376 wrote to memory of 2332	2376	WindowsHeath.exe	162
PID 2332 wrote to memory of 5728	2332	cmd.exe	164
PID 2760 wrote to memory of 4508	2760	WindowsHeath.exe	165
PID 4508 wrote to memory of 4552	4508	cmd.exe	167
PID 2376 wrote to memory of 4324	2376	WindowsHeath.exe	168
PID 4324 wrote to memory of 5232	4324	cmd.exe	170
PID 2376 wrote to memory of 2008	2376	WindowsHeath.exe	171
PID 2008 wrote to memory of 4976	2008	cmd.exe	173
PID 2376 wrote to memory of 3348	2376	WindowsHeath.exe	174
PID 3348 wrote to memory of 3020	3348	cmd.exe	176
PID 2376 wrote to memory of 5992	2376	WindowsHeath.exe	177
PID 5992 wrote to memory of 4284	5992	cmd.exe	179
PID 2376 wrote to memory of 3652	2376	WindowsHeath.exe	180
PID 3652 wrote to memory of 3544	3652	cmd.exe	182
PID 2376 wrote to memory of 4352	2376	WindowsHeath.exe	183
PID 4352 wrote to memory of 6028	4352	cmd.exe	185
PID 2376 wrote to memory of 4732	2376	WindowsHeath.exe	186
PID 4732 wrote to memory of 2536	4732	cmd.exe	188
PID 2376 wrote to memory of 4304	2376	WindowsHeath.exe	189
PID 4304 wrote to memory of 5520	4304	cmd.exe	191

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\проверка.exe
"C:\Users\Admin\AppData\Local\Temp\проверка.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="L41Oa8c=a1>Qax" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" enable=yes & exit
  2⤵
  PID:3552
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4800
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1972
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4848

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1812
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1196
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1696
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4732
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3768
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4260
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4852
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2084
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5344
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4584
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4908
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5060
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5200
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:244
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3376
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3308
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6064
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2912
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4320
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5728
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5232
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4976
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3020
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4284
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3544
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6028
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2536
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5520
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3988
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1064

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4984

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsHeath.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
Size 121KB
SHA256 06357c44f52d222e000677990314c4a89aee7001b86402d96a58b2081b3a9b1b
MD5 1026f25a673719cee828c7ec9f1a223a
SHA1 ffa3370b6fdaebefd46b610379c4ee29e4fc1d45
SHA512 ab39d9ee0fe428d2a81fbcd9ab9b3ef4b98eb911bea1d3b0736198080061635fe075ec81edf4bb9e07d14e23154f85606047d95c6352fbe2ea337e273f88f1b5
SSDEEP 768:rFk0yK0+zke2wBuX2/Igrgafi54EbXBvnsf6HObdi0wDjm+LaYKumIlAp2SbcY89:ZHyK0g2wBuXRqHCjObUnDa+LBKj0fZ
TLSH
T1F3C3D3447384D911D4AD1EB48E42F3C98379AE076D12E30B3D8AB39E2F762C5D616ED2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-6-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1052-2-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1052-3-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1052-4-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1052-5-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1052-0-0x00000198B0D90000-0x00000198B0DB4000-memory.dmp

Download

memory/1052-7-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1052-8-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1052-9-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1052-1-0x00007FFD1E61F000-0x00007FFD1E620000-memory.dmp

Download

memory/1052-31-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1052-90-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads