sheetrat | a4895d35b29bd056cfedbf16a7fc28f4d1ce00795e395a68155c02eb89d616bc

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Spufferr.exe
Size 121KB
Sample260808-nynpgazxc1
SHA256 a4895d35b29bd056cfedbf16a7fc28f4d1ce00795e395a68155c02eb89d616bc
MD5 37ac69c903d0c1c196b3159a55417dcb
SHA1 17e2bab3497fe60327d2f145e93f5e6cf22abae6
SHA512 0229c758609ee56eed22c314305109e1718f9dfae9bc3b54f8dac6288be5c22309c8874734320d2d06836a9f945e9d6e105907c7b2a0db9ae739c5d49dbfa221
SSDEEP 768:1FEZNK0jcMz9JhLiFbcpW4BaT4w02GG1Mnhf6HObdMPwZjLNxfenlAqSbcY8jZ:7EZNK0lz9JhLiFbshSObioZvSl7h
TLSH
T170C3D5497784C950D1AE0A7A8E52F3C49335BD236D02E30A3D8AB39D3E3B3D58A15DD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

gay12311 discovery execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

gay12311

91.92.47.228:1360

Mutex

Attributes

anti_virtual
false
certificate
50232ofm02vqtanxxlk
exclusion_wd
true
hidden_file
true
install
true
install_watch_dog
true
key
pfim5qeq
path_client
%Cookies%\WindowsHeath.exe
path_watch_dog
%Templates%\svchost.exe
pump
false
rootkit
false
task_client
svchost.exe
use_install_admin
true
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/2108-0-0x000001E4B1540000-0x000001E4B1564000-memory.dmp	family_sheetrat_v1
behavioral2/files/0x0003000000000432-10.dat	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\WindowsHeath.exe"	Spufferr.exe

Executes dropped EXE 5 IoCs

pid	Process
4788	WindowsHeath.exe
4564	WindowsHeath.exe
4540	WindowsHeath.exe
5936	WindowsHeath.exe
2196	WindowsHeath.exe

Looks up external IP address via web service 1 TTPs 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com
7	api.ipify.org
8	api.ipify.org
11	icanhazip.com
13	api.ipify.org
19	api.ipify.org
24	api.ipify.org
1	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 34 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
620	cmd.exe
3484	cmd.exe
4200	cmd.exe
4232	cmd.exe
1744	cmd.exe
4524	cmd.exe
1984	cmd.exe
1088	cmd.exe
1348	cmd.exe
4596	cmd.exe
4100	cmd.exe
860	cmd.exe
4312	cmd.exe
3252	cmd.exe
1048	cmd.exe
4608	cmd.exe
4928	cmd.exe
2832	cmd.exe
4104	cmd.exe
4472	cmd.exe
2288	cmd.exe
1192	cmd.exe
992	cmd.exe
3272	cmd.exe
5732	cmd.exe
1000	cmd.exe
6036	cmd.exe
264	cmd.exe
5724	cmd.exe
1332	cmd.exe
2588	cmd.exe
4172	cmd.exe
2148	cmd.exe
2660	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 34 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5992	schtasks.exe
2096	schtasks.exe
4384	schtasks.exe
5576	schtasks.exe
5116	schtasks.exe
6024	schtasks.exe
3012	schtasks.exe
4588	schtasks.exe
2424	schtasks.exe
5632	schtasks.exe
1484	schtasks.exe
1564	schtasks.exe
1668	schtasks.exe
4308	schtasks.exe
4212	schtasks.exe
4652	schtasks.exe
5036	schtasks.exe
2556	schtasks.exe
2224	schtasks.exe
4520	schtasks.exe
4940	schtasks.exe
2668	schtasks.exe
1300	schtasks.exe
1036	schtasks.exe
5956	schtasks.exe
5068	schtasks.exe
3036	schtasks.exe
3880	schtasks.exe
1584	schtasks.exe
4928	schtasks.exe
632	schtasks.exe
5608	schtasks.exe
3736	schtasks.exe
1780	schtasks.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	Spufferr.exe
Token: SeDebugPrivilege	4788	WindowsHeath.exe
Token: SeDebugPrivilege	4564	WindowsHeath.exe
Token: SeIncBasePriorityPrivilege	4788	WindowsHeath.exe
Token: SeDebugPrivilege	4540	WindowsHeath.exe
Token: SeDebugPrivilege	5936	WindowsHeath.exe
Token: SeDebugPrivilege	2196	WindowsHeath.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1472	2108	Spufferr.exe	91
PID 2108 wrote to memory of 620	2108	Spufferr.exe	92
PID 620 wrote to memory of 6024	620	cmd.exe	95
PID 2108 wrote to memory of 3484	2108	Spufferr.exe	96
PID 3484 wrote to memory of 3012	3484	cmd.exe	98
PID 2108 wrote to memory of 4564	2108	Spufferr.exe	101
PID 4788 wrote to memory of 4200	4788	WindowsHeath.exe	102
PID 4200 wrote to memory of 1584	4200	cmd.exe	104
PID 4564 wrote to memory of 4232	4564	WindowsHeath.exe	105
PID 4232 wrote to memory of 4588	4232	cmd.exe	107
PID 4788 wrote to memory of 1048	4788	WindowsHeath.exe	108
PID 1048 wrote to memory of 3736	1048	cmd.exe	110
PID 4788 wrote to memory of 2832	4788	WindowsHeath.exe	111
PID 2832 wrote to memory of 4308	2832	cmd.exe	113
PID 4788 wrote to memory of 1088	4788	WindowsHeath.exe	114
PID 1088 wrote to memory of 5992	1088	cmd.exe	116
PID 4540 wrote to memory of 1744	4540	WindowsHeath.exe	118
PID 1744 wrote to memory of 2424	1744	cmd.exe	120
PID 4788 wrote to memory of 5732	4788	WindowsHeath.exe	121
PID 5732 wrote to memory of 2096	5732	cmd.exe	123
PID 4788 wrote to memory of 1348	4788	WindowsHeath.exe	125
PID 1348 wrote to memory of 2668	1348	cmd.exe	127
PID 4788 wrote to memory of 1000	4788	WindowsHeath.exe	128
PID 1000 wrote to memory of 4928	1000	cmd.exe	130
PID 4788 wrote to memory of 4524	4788	WindowsHeath.exe	131
PID 4524 wrote to memory of 4384	4524	cmd.exe	133
PID 4788 wrote to memory of 4596	4788	WindowsHeath.exe	134
PID 4596 wrote to memory of 1300	4596	cmd.exe	136
PID 4788 wrote to memory of 2588	4788	WindowsHeath.exe	137
PID 2588 wrote to memory of 1036	2588	cmd.exe	139
PID 4788 wrote to memory of 4100	4788	WindowsHeath.exe	140
PID 4100 wrote to memory of 5576	4100	cmd.exe	142
PID 4788 wrote to memory of 860	4788	WindowsHeath.exe	143
PID 860 wrote to memory of 2556	860	cmd.exe	145
PID 4788 wrote to memory of 6036	4788	WindowsHeath.exe	146
PID 6036 wrote to memory of 5632	6036	cmd.exe	148
PID 4788 wrote to memory of 264	4788	WindowsHeath.exe	149
PID 264 wrote to memory of 5116	264	cmd.exe	151
PID 4788 wrote to memory of 2288	4788	WindowsHeath.exe	152
PID 2288 wrote to memory of 1484	2288	cmd.exe	154
PID 4788 wrote to memory of 5724	4788	WindowsHeath.exe	156
PID 5724 wrote to memory of 4212	5724	cmd.exe	158
PID 5936 wrote to memory of 4312	5936	WindowsHeath.exe	159
PID 4312 wrote to memory of 632	4312	cmd.exe	161
PID 4788 wrote to memory of 4104	4788	WindowsHeath.exe	162
PID 4104 wrote to memory of 5956	4104	cmd.exe	164
PID 4788 wrote to memory of 4172	4788	WindowsHeath.exe	165
PID 4172 wrote to memory of 2224	4172	cmd.exe	167
PID 4788 wrote to memory of 3252	4788	WindowsHeath.exe	168
PID 3252 wrote to memory of 1564	3252	cmd.exe	170
PID 4788 wrote to memory of 4608	4788	WindowsHeath.exe	171
PID 4608 wrote to memory of 4652	4608	cmd.exe	173
PID 4788 wrote to memory of 1192	4788	WindowsHeath.exe	174
PID 1192 wrote to memory of 5608	1192	cmd.exe	176
PID 4788 wrote to memory of 1984	4788	WindowsHeath.exe	177
PID 1984 wrote to memory of 4520	1984	cmd.exe	179
PID 4788 wrote to memory of 4472	4788	WindowsHeath.exe	180
PID 4472 wrote to memory of 4940	4472	cmd.exe	182
PID 4788 wrote to memory of 2148	4788	WindowsHeath.exe	183
PID 2148 wrote to memory of 1668	2148	cmd.exe	185
PID 4788 wrote to memory of 2660	4788	WindowsHeath.exe	186
PID 2660 wrote to memory of 1780	2660	cmd.exe	188
PID 4788 wrote to memory of 1332	4788	WindowsHeath.exe	189
PID 1332 wrote to memory of 5068	1332	cmd.exe	191

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Spufferr.exe
"C:\Users\Admin\AppData\Local\Temp\Spufferr.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="VLk+i%p0ikNziv" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" enable=yes & exit
  2⤵
  PID:1472
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6024
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3012
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4588

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1584
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3736
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4308
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5992
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2668
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4928
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4384
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1300
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1036
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5576
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2556
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5632
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5116
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1484
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4212
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5956
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2224
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1564
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4652
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5608
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4520
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4940
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1668
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1780
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5068
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:992
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5036
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3272
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3036

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2424

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:632

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2196
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4928
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsHeath.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
Size 121KB
SHA256 a4895d35b29bd056cfedbf16a7fc28f4d1ce00795e395a68155c02eb89d616bc
MD5 37ac69c903d0c1c196b3159a55417dcb
SHA1 17e2bab3497fe60327d2f145e93f5e6cf22abae6
SHA512 0229c758609ee56eed22c314305109e1718f9dfae9bc3b54f8dac6288be5c22309c8874734320d2d06836a9f945e9d6e105907c7b2a0db9ae739c5d49dbfa221
SSDEEP 768:1FEZNK0jcMz9JhLiFbcpW4BaT4w02GG1Mnhf6HObdMPwZjLNxfenlAqSbcY8jZ:7EZNK0lz9JhLiFbshSObioZvSl7h
TLSH
T170C3D5497784C950D1AE0A7A8E52F3C49335BD236D02E30A3D8AB39D3E3B3D58A15DD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2108-1-0x00007FFEBC44F000-0x00007FFEBC450000-memory.dmp

Download

memory/2108-0-0x000001E4B1540000-0x000001E4B1564000-memory.dmp

Download

memory/2108-2-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/2108-3-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/2108-4-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/2108-5-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

memory/2108-85-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads