sheetrat | e5071a52d4b3b6a684aa7c274790bcafb526d182d2d4d2b6dae8b7935fcbb941

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sv1nLocker.exe
Size 121KB
Sample260810-pjenpaybpf
SHA256 e5071a52d4b3b6a684aa7c274790bcafb526d182d2d4d2b6dae8b7935fcbb941
MD5 38a8301892ee64e5a97fc046d7cff6c1
SHA1 7fda779ffa53a668e38ecc2f9b92dce22fbc9017
SHA512 96414a3e4760db3fbdb9ed83aa1d14f895785d174046cc45d4629e81fb482935929387a7c469995d27fed20065838d09f7bd06a231ba39e348479296ccba3980
SSDEEP 1536:BELOK0rZBvcYzWrQzBXnvjObU5N92F0wZ:6O2rCB3vjObU5b2lZ
TLSH
T1F8C3D3447784C950D4AE1AB59E13E3C49339FD636D12E30A3D8AB39D2F363D88906EE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

gay12311 discovery execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

gay12311

91.92.47.228:1360

Mutex

Attributes

anti_virtual
false
certificate
4p7bzzmfqz4zgox9j0boeendqlt
exclusion_wd
true
hidden_file
true
install
true
install_watch_dog
true
key
74eorxr972cwfld1wm4
path_client
%Cookies%\WindowsHeath.exe
path_watch_dog
%Templates%\svchost.exe
pump
false
rootkit
false
task_client
svchost.exe
use_install_admin
true
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/2624-1-0x0000019A7F4B0000-0x0000019A7F4D4000-memory.dmp	family_sheetrat_v1
behavioral2/files/0x000d00000001c5d3-11.dat	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\WindowsHeath.exe"	sv1nLocker.exe

Executes dropped EXE 4 IoCs

pid	Process
1620	WindowsHeath.exe
4428	WindowsHeath.exe
5948	WindowsHeath.exe
5472	WindowsHeath.exe

Looks up external IP address via web service 1 TTPs 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com
2	api.ipify.org
3	api.ipify.org
5	api.ipify.org
9	api.ipify.org
11	icanhazip.com
1	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 33 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4720	cmd.exe
1992	cmd.exe
3312	cmd.exe
2128	cmd.exe
1268	cmd.exe
5780	cmd.exe
1764	cmd.exe
5084	cmd.exe
720	cmd.exe
5108	cmd.exe
5188	cmd.exe
5204	cmd.exe
5440	cmd.exe
3400	cmd.exe
4712	cmd.exe
5056	cmd.exe
3360	cmd.exe
3016	cmd.exe
4256	cmd.exe
1324	cmd.exe
3636	cmd.exe
2260	cmd.exe
752	cmd.exe
3556	cmd.exe
1616	cmd.exe
2612	cmd.exe
4184	cmd.exe
4368	cmd.exe
4124	cmd.exe
5572	cmd.exe
3944	cmd.exe
3856	cmd.exe
5492	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5632	schtasks.exe
4260	schtasks.exe
6116	schtasks.exe
300	schtasks.exe
3200	schtasks.exe
5524	schtasks.exe
3036	schtasks.exe
1736	schtasks.exe
1996	schtasks.exe
4580	schtasks.exe
4248	schtasks.exe
4116	schtasks.exe
3476	schtasks.exe
4236	schtasks.exe
4536	schtasks.exe
5320	schtasks.exe
4888	schtasks.exe
4636	schtasks.exe
6132	schtasks.exe
2964	schtasks.exe
5224	schtasks.exe
5840	schtasks.exe
2412	schtasks.exe
2808	schtasks.exe
3040	schtasks.exe
5508	schtasks.exe
3092	schtasks.exe
712	schtasks.exe
1560	schtasks.exe
300	schtasks.exe
824	schtasks.exe
2144	schtasks.exe
4924	schtasks.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	sv1nLocker.exe
Token: SeDebugPrivilege	1620	WindowsHeath.exe
Token: SeDebugPrivilege	4428	WindowsHeath.exe
Token: SeIncBasePriorityPrivilege	1620	WindowsHeath.exe
Token: SeDebugPrivilege	5948	WindowsHeath.exe
Token: SeDebugPrivilege	5472	WindowsHeath.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1704	2624	sv1nLocker.exe	91
PID 2624 wrote to memory of 3312	2624	sv1nLocker.exe	92
PID 3312 wrote to memory of 300	3312	cmd.exe	95
PID 2624 wrote to memory of 3016	2624	sv1nLocker.exe	96
PID 3016 wrote to memory of 4888	3016	cmd.exe	98
PID 2624 wrote to memory of 1620	2624	sv1nLocker.exe	99
PID 1620 wrote to memory of 2612	1620	WindowsHeath.exe	102
PID 2612 wrote to memory of 3092	2612	cmd.exe	104
PID 4428 wrote to memory of 5572	4428	WindowsHeath.exe	105
PID 5572 wrote to memory of 4248	5572	cmd.exe	107
PID 1620 wrote to memory of 2128	1620	WindowsHeath.exe	108
PID 2128 wrote to memory of 4116	2128	cmd.exe	110
PID 1620 wrote to memory of 5440	1620	WindowsHeath.exe	112
PID 5440 wrote to memory of 5840	5440	cmd.exe	114
PID 1620 wrote to memory of 3400	1620	WindowsHeath.exe	115
PID 3400 wrote to memory of 4924	3400	cmd.exe	117
PID 1620 wrote to memory of 3944	1620	WindowsHeath.exe	119
PID 3944 wrote to memory of 5632	3944	cmd.exe	121
PID 1620 wrote to memory of 4712	1620	WindowsHeath.exe	122
PID 4712 wrote to memory of 712	4712	cmd.exe	124
PID 1620 wrote to memory of 5780	1620	WindowsHeath.exe	126
PID 5780 wrote to memory of 3476	5780	cmd.exe	128
PID 5948 wrote to memory of 1764	5948	WindowsHeath.exe	129
PID 1764 wrote to memory of 1560	1764	cmd.exe	131
PID 1620 wrote to memory of 5084	1620	WindowsHeath.exe	132
PID 5084 wrote to memory of 2412	5084	cmd.exe	134
PID 1620 wrote to memory of 720	1620	WindowsHeath.exe	135
PID 720 wrote to memory of 4260	720	cmd.exe	137
PID 1620 wrote to memory of 752	1620	WindowsHeath.exe	138
PID 752 wrote to memory of 4236	752	cmd.exe	140
PID 1620 wrote to memory of 4720	1620	WindowsHeath.exe	141
PID 4720 wrote to memory of 4636	4720	cmd.exe	143
PID 1620 wrote to memory of 4256	1620	WindowsHeath.exe	144
PID 4256 wrote to memory of 6116	4256	cmd.exe	146
PID 1620 wrote to memory of 5056	1620	WindowsHeath.exe	147
PID 5056 wrote to memory of 2808	5056	cmd.exe	149
PID 1620 wrote to memory of 4184	1620	WindowsHeath.exe	150
PID 4184 wrote to memory of 6132	4184	cmd.exe	152
PID 1620 wrote to memory of 3856	1620	WindowsHeath.exe	153
PID 3856 wrote to memory of 300	3856	cmd.exe	155
PID 1620 wrote to memory of 5492	1620	WindowsHeath.exe	156
PID 5492 wrote to memory of 1996	5492	cmd.exe	158
PID 1620 wrote to memory of 3556	1620	WindowsHeath.exe	159
PID 3556 wrote to memory of 2964	3556	cmd.exe	161
PID 1620 wrote to memory of 3360	1620	WindowsHeath.exe	162
PID 3360 wrote to memory of 3200	3360	cmd.exe	164
PID 1620 wrote to memory of 5108	1620	WindowsHeath.exe	166
PID 5108 wrote to memory of 5524	5108	cmd.exe	168
PID 1620 wrote to memory of 1324	1620	WindowsHeath.exe	169
PID 1324 wrote to memory of 3036	1324	cmd.exe	171
PID 5472 wrote to memory of 3636	5472	WindowsHeath.exe	172
PID 3636 wrote to memory of 1736	3636	cmd.exe	174
PID 1620 wrote to memory of 4368	1620	WindowsHeath.exe	175
PID 4368 wrote to memory of 3040	4368	cmd.exe	177
PID 1620 wrote to memory of 1268	1620	WindowsHeath.exe	178
PID 1268 wrote to memory of 4580	1268	cmd.exe	180
PID 1620 wrote to memory of 2260	1620	WindowsHeath.exe	181
PID 2260 wrote to memory of 4536	2260	cmd.exe	183
PID 1620 wrote to memory of 4124	1620	WindowsHeath.exe	184
PID 4124 wrote to memory of 824	4124	cmd.exe	186
PID 1620 wrote to memory of 5188	1620	WindowsHeath.exe	187
PID 5188 wrote to memory of 5508	5188	cmd.exe	189
PID 1620 wrote to memory of 1616	1620	WindowsHeath.exe	190
PID 1616 wrote to memory of 5224	1616	cmd.exe	192

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sv1nLocker.exe
"C:\Users\Admin\AppData\Local\Temp\sv1nLocker.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="9VUwB_;oBUc|Bn" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" enable=yes & exit
  2⤵
  PID:1704
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:300
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4888
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3092
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4116
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5440
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5840
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4924
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5632
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:712
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5780
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3476
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2412
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4260
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4236
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4636
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6116
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2808
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6132
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:300
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5492
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1996
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2964
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3200
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5524
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3036
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3040
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4580
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4536
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:824
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5188
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5508
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5224
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1992
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2144
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5204
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5320

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2196

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1560

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5472
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsHeath.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
Size 121KB
SHA256 e5071a52d4b3b6a684aa7c274790bcafb526d182d2d4d2b6dae8b7935fcbb941
MD5 38a8301892ee64e5a97fc046d7cff6c1
SHA1 7fda779ffa53a668e38ecc2f9b92dce22fbc9017
SHA512 96414a3e4760db3fbdb9ed83aa1d14f895785d174046cc45d4629e81fb482935929387a7c469995d27fed20065838d09f7bd06a231ba39e348479296ccba3980
SSDEEP 1536:BELOK0rZBvcYzWrQzBXnvjObU5N92F0wZ:6O2rCB3vjObU5b2lZ
TLSH
T1F8C3D3447784C950D4AE1AB59E13E3C49339FD636D12E30A3D8AB39D2F363D88906EE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2624-0-0x00007FFDF3EFF000-0x00007FFDF3F00000-memory.dmp

Download

memory/2624-1-0x0000019A7F4B0000-0x0000019A7F4D4000-memory.dmp

Download

memory/2624-2-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/2624-3-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/2624-4-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/2624-5-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/2624-6-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/2624-86-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads