sheetrat | 4984d65a50623d83dbbdd275f936d9c76b1af5b3bd298892aa543f8c8f5d6491

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 330KB
Sample260808-k97pyacp5w
SHA256 4984d65a50623d83dbbdd275f936d9c76b1af5b3bd298892aa543f8c8f5d6491
MD5 94c636be147ec85e1aeca08d1e106eb3
SHA1 c0e7834796796e3cec37808412170d9b47d2a7d8
SHA512 9950bdb35c177b19e46c50222c01e4c07cf5f5d17d794ea7267757c14346052583decd1107daf1b42ecb2387631951a5d5ac0d291214ee08465b0fbc78fae408
SSDEEP 6144:DC827UNQwIFjPl9AKVe6VlWT8b9WX2+yh/GQIr5AsdHbA3Lg:DC82wK7jjAKVPVle8gX2SQIrPm
TLSH
T13E74D40CFEA1E805DD1E3E77CBE610004B7121C22F21929672996FFC9B597B658A35BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_axyargdqqzmye execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_axyargdqqzmye

192.168.122.212:3765

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/5068-0-0x0000000000980000-0x00000000009D8000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral2/memory/5068-0-0x0000000000980000-0x00000000009D8000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Public\\Documents\\xdwdInkscape.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 2 IoCs

pid	Process
5288	xdwdUnity.exe
3340	xdwdInkscape.exe

Loads dropped DLL 50 IoCs

pid	Process
1664	Process not Found
1100	Process not Found
1312	Process not Found
2876	Process not Found
4688	Process not Found
5616	Process not Found
5288	xdwdUnity.exe
3340	xdwdInkscape.exe
4296	Process not Found
936	Process not Found
4564	Process not Found
3280	Process not Found
5908	Process not Found
4196	Process not Found
1200	Process not Found
1292	Process not Found
1908	Process not Found
5544	Process not Found
5248	Process not Found
3396	Process not Found
1208	Process not Found
5048	Process not Found
4340	Process not Found
4600	Process not Found
5280	Process not Found
1428	Process not Found
4376	Process not Found
2176	Process not Found
1184	Process not Found
1316	Process not Found
2532	Process not Found
4140	Process not Found
1152	Process not Found
4492	Process not Found
5308	Process not Found
2788	Process not Found
4552	Process not Found
6036	Process not Found
3280	Process not Found
3852	Process not Found
3888	Process not Found
1200	Process not Found
5844	Process not Found
2208	Process not Found
4248	Process not Found
2356	Process not Found
1852	Process not Found
2948	Process not Found
5736	Process not Found
2440	Process not Found

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Executes a command shell one-liner 1 TTPs 48 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4544	CMD.exe
4644	CMD.exe
5092	CMD.exe
6068	CMD.exe
2956	CMD.exe
552	CMD.exe
2864	CMD.exe
1016	CMD.exe
1892	CMD.exe
4548	CMD.exe
1760	CMD.exe
4860	CMD.exe
4816	CMD.exe
5920	CMD.exe
4856	CMD.exe
2644	CMD.exe
5124	CMD.exe
5456	CMD.exe
4624	CMD.exe
4924	CMD.exe
2012	CMD.exe
5752	CMD.exe
3296	CMD.exe
4880	CMD.exe
4576	CMD.exe
3672	CMD.exe
5976	CMD.exe
2548	CMD.exe
3352	CMD.exe
3208	CMD.exe
5020	CMD.exe
3372	CMD.exe
1212	CMD.exe
2828	CMD.exe
1848	CMD.exe
4152	CMD.exe
968	CMD.exe
5732	CMD.exe
4408	CMD.exe
4272	CMD.exe
4940	CMD.exe
2168	CMD.exe
4308	CMD.exe
5812	CMD.exe
204	CMD.exe
4472	CMD.exe
1388	CMD.exe
3496	CMD.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1764	schtasks.exe
2080	schtasks.exe
4724	schtasks.exe
4512	schtasks.exe
4428	schtasks.exe
3576	schtasks.exe
3556	schtasks.exe
3476	schtasks.exe
5552	schtasks.exe
4324	schtasks.exe
3124	schtasks.exe
3332	schtasks.exe
5812	schtasks.exe
4816	schtasks.exe
2776	schtasks.exe
2084	schtasks.exe
2236	schtasks.exe
4688	schtasks.exe
3820	schtasks.exe
2908	schtasks.exe
2672	schtasks.exe
2136	schtasks.exe
3476	schtasks.exe
5156	schtasks.exe
2620	schtasks.exe
3416	schtasks.exe
1464	schtasks.exe
4312	schtasks.exe
5696	schtasks.exe
1356	schtasks.exe
3396	schtasks.exe
6092	schtasks.exe
1900	schtasks.exe
2012	schtasks.exe
5100	schtasks.exe
2768	schtasks.exe
5376	schtasks.exe
1680	schtasks.exe
1136	schtasks.exe
4840	schtasks.exe
4296	schtasks.exe
3416	schtasks.exe
672	schtasks.exe
4184	schtasks.exe
1060	schtasks.exe
2908	schtasks.exe
4924	schtasks.exe
4752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5288	xdwdUnity.exe
5288	xdwdUnity.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	Client.exe
Token: SeDebugPrivilege	5288	xdwdUnity.exe
Token: SeDebugPrivilege	3340	xdwdInkscape.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 3672	5068	Client.exe	90
PID 3672 wrote to memory of 672	3672	CMD.exe	92
PID 5068 wrote to memory of 4548	5068	Client.exe	93
PID 4548 wrote to memory of 6092	4548	CMD.exe	95
PID 5068 wrote to memory of 4940	5068	Client.exe	96
PID 4940 wrote to memory of 1680	4940	CMD.exe	98
PID 5068 wrote to memory of 4644	5068	Client.exe	101
PID 4644 wrote to memory of 2908	4644	CMD.exe	103
PID 5068 wrote to memory of 2168	5068	Client.exe	104
PID 2168 wrote to memory of 3576	2168	CMD.exe	106
PID 5068 wrote to memory of 3372	5068	Client.exe	107
PID 3372 wrote to memory of 3820	3372	CMD.exe	109
PID 5068 wrote to memory of 1212	5068	Client.exe	113
PID 1212 wrote to memory of 3556	1212	CMD.exe	115
PID 5068 wrote to memory of 5092	5068	Client.exe	116
PID 5092 wrote to memory of 3124	5092	CMD.exe	118
PID 5068 wrote to memory of 4472	5068	Client.exe	119
PID 4472 wrote to memory of 3416	4472	CMD.exe	121
PID 5068 wrote to memory of 5752	5068	Client.exe	122
PID 5752 wrote to memory of 3332	5752	CMD.exe	124
PID 5068 wrote to memory of 5920	5068	Client.exe	125
PID 5920 wrote to memory of 5812	5920	CMD.exe	127
PID 5288 wrote to memory of 5976	5288	xdwdUnity.exe	128
PID 5976 wrote to memory of 1464	5976	CMD.exe	130
PID 5068 wrote to memory of 4308	5068	Client.exe	131
PID 4308 wrote to memory of 3476	4308	CMD.exe	133
PID 3340 wrote to memory of 4272	3340	xdwdInkscape.exe	134
PID 4272 wrote to memory of 4312	4272	CMD.exe	136
PID 5068 wrote to memory of 1388	5068	Client.exe	137
PID 1388 wrote to memory of 4816	1388	CMD.exe	139
PID 3340 wrote to memory of 2828	3340	xdwdInkscape.exe	140
PID 2828 wrote to memory of 4924	2828	CMD.exe	142
PID 5068 wrote to memory of 1848	5068	Client.exe	143
PID 1848 wrote to memory of 1900	1848	CMD.exe	145
PID 5068 wrote to memory of 4856	5068	Client.exe	146
PID 4856 wrote to memory of 1136	4856	CMD.exe	148
PID 5068 wrote to memory of 1760	5068	Client.exe	149
PID 1760 wrote to memory of 2012	1760	CMD.exe	151
PID 5068 wrote to memory of 2644	5068	Client.exe	152
PID 2644 wrote to memory of 5100	2644	CMD.exe	154
PID 5068 wrote to memory of 3296	5068	Client.exe	155
PID 3296 wrote to memory of 2776	3296	CMD.exe	157
PID 5068 wrote to memory of 4152	5068	Client.exe	158
PID 4152 wrote to memory of 4840	4152	CMD.exe	160
PID 5068 wrote to memory of 6068	5068	Client.exe	161
PID 6068 wrote to memory of 4752	6068	CMD.exe	163
PID 5068 wrote to memory of 2956	5068	Client.exe	164
PID 2956 wrote to memory of 2084	2956	CMD.exe	166
PID 5068 wrote to memory of 5124	5068	Client.exe	167
PID 5124 wrote to memory of 1764	5124	CMD.exe	169
PID 5068 wrote to memory of 4880	5068	Client.exe	170
PID 4880 wrote to memory of 2908	4880	CMD.exe	172
PID 5068 wrote to memory of 2548	5068	Client.exe	173
PID 2548 wrote to memory of 2236	2548	CMD.exe	175
PID 5068 wrote to memory of 5456	5068	Client.exe	176
PID 5456 wrote to memory of 2080	5456	CMD.exe	178
PID 5068 wrote to memory of 552	5068	Client.exe	179
PID 552 wrote to memory of 4688	552	CMD.exe	181
PID 5068 wrote to memory of 968	5068	Client.exe	182
PID 968 wrote to memory of 2672	968	CMD.exe	184
PID 5068 wrote to memory of 3352	5068	Client.exe	185
PID 3352 wrote to memory of 4184	3352	CMD.exe	187
PID 5068 wrote to memory of 5732	5068	Client.exe	188
PID 5732 wrote to memory of 4724	5732	CMD.exe	190

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Google SketchUp" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Google SketchUp" /tr "C:\Users\Public\Documents\xdwdInkscape.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:672
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6092
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Publisher Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdUnity.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Publisher Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdUnity.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3820
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4816
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1136
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2012
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4840
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2084
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1764
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2080
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2672
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4576
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2136
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4624
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4296
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3208
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4428
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1016
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4544
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:204
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3396
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1892
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4324

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdUnity.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdUnity.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5288
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1464

C:\Users\Public\Documents\xdwdInkscape.exe
C:\Users\Public\Documents\xdwdInkscape.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4312
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker Upgrade" /tr "C:\Users\Public\Documents\xdwdInkscape.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5068-1-0x00007FFBBF08F000-0x00007FFBBF090000-memory.dmp

Download

memory/5068-0-0x0000000000980000-0x00000000009D8000-memory.dmp

Download

memory/5068-2-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5068-3-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5068-4-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5068-5-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5068-6-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5068-38-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5068-123-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download