sheetrat | 35e7e995d369375df8e05ea92b804631a9487acaf088f33e84174ab079c3d529

Analysis

user interaction
yes
max time kernel
67s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/08/2026, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
protected_Client.exe
Size 826KB
Sample260813-kvsbpsvtaw
SHA256 35e7e995d369375df8e05ea92b804631a9487acaf088f33e84174ab079c3d529
MD5 bbfebdc2469b08f8c532e3fb01769b31
SHA1 aa33ceed41bf63a42e1419474d15e3c8aefbc0ae
SHA512 8e88e1706f3afa1fa2f492d8e110ae17b8941b2d636b26154546e98bd8a595c85b242f392483915e74251315d0fb6fecbd02e0e91803fe3c99188a67a0a36a91
SSDEEP 24576:Jwujv8MVNPLUpXDjbJ4+El9J9sJ23vC03:JFjv8C6TizFsAK03
TLSH
T16F05F11EB66141FCE06BC47882416536FB3274574B32AAEB17E406243E67AF25F3CB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_iyckgtpojp credential_access discovery execution sheetrat persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_iyckgtpojp

atoms-mgmt.tun.ply.gg:38379

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/2128-3-0x000000001F720000-0x000000001F7B4000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral1/memory/2128-3-0x000000001F720000-0x000000001F7B4000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\xdwdOracle VirtualBox.exe"	protected_Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Loads dropped DLL 13 IoCs

pid	Process
1964	Process not Found
2160	Process not Found
3648	WmiApSrv.exe
3668	Process not Found
2448	Process not Found
4864	Process not Found
1508	Process not Found
1120	Process not Found
4588	Process not Found
5036	Process not Found
1692	Process not Found
2056	Process not Found
3124	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2128	protected_Client.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	protected_Client.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 29 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4040	CMD.exe
2404	CMD.exe
3748	CMD.exe
4464	CMD.exe
1392	CMD.exe
1116	CMD.exe
3300	CMD.exe
4536	CMD.exe
2000	CMD.exe
3008	CMD.exe
884	CMD.exe
788	CMD.exe
2232	CMD.exe
3408	CMD.exe
740	CMD.exe
4712	CMD.exe
3228	CMD.exe
2416	CMD.exe
4456	CMD.exe
2296	CMD.exe
1644	CMD.exe
1508	CMD.exe
3348	CMD.exe
2828	CMD.exe
3508	CMD.exe
3864	CMD.exe
488	CMD.exe
4972	CMD.exe
3640	CMD.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 29 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2588	schtasks.exe
2596	schtasks.exe
2468	schtasks.exe
4528	schtasks.exe
2912	schtasks.exe
4448	schtasks.exe
1232	schtasks.exe
672	schtasks.exe
4596	schtasks.exe
3188	schtasks.exe
1656	schtasks.exe
408	schtasks.exe
2372	schtasks.exe
1192	schtasks.exe
4380	schtasks.exe
780	schtasks.exe
2000	schtasks.exe
1412	schtasks.exe
2336	schtasks.exe
4716	schtasks.exe
1872	schtasks.exe
1084	schtasks.exe
3888	schtasks.exe
640	schtasks.exe
4436	schtasks.exe
4824	schtasks.exe
2508	schtasks.exe
552	schtasks.exe
4236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
3648	WmiApSrv.exe
3648	WmiApSrv.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe
2128	protected_Client.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	protected_Client.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 4040	2128	protected_Client.exe	81
PID 4040 wrote to memory of 3188	4040	CMD.exe	83
PID 2128 wrote to memory of 3864	2128	protected_Client.exe	84
PID 3864 wrote to memory of 780	3864	CMD.exe	86
PID 2128 wrote to memory of 488	2128	protected_Client.exe	90
PID 488 wrote to memory of 1872	488	CMD.exe	92
PID 2128 wrote to memory of 884	2128	protected_Client.exe	94
PID 884 wrote to memory of 2596	884	CMD.exe	96
PID 2128 wrote to memory of 4456	2128	protected_Client.exe	99
PID 4456 wrote to memory of 2372	4456	CMD.exe	101
PID 2128 wrote to memory of 2296	2128	protected_Client.exe	102
PID 2296 wrote to memory of 4436	2296	CMD.exe	104
PID 2128 wrote to memory of 1644	2128	protected_Client.exe	105
PID 1644 wrote to memory of 672	1644	CMD.exe	107
PID 2128 wrote to memory of 3408	2128	protected_Client.exe	108
PID 3408 wrote to memory of 2000	3408	CMD.exe	110
PID 2128 wrote to memory of 2404	2128	protected_Client.exe	111
PID 2404 wrote to memory of 4824	2404	CMD.exe	113
PID 2128 wrote to memory of 3300	2128	protected_Client.exe	114
PID 3300 wrote to memory of 2468	3300	CMD.exe	116
PID 2128 wrote to memory of 3748	2128	protected_Client.exe	117
PID 3748 wrote to memory of 1656	3748	CMD.exe	119
PID 2128 wrote to memory of 1508	2128	protected_Client.exe	120
PID 1508 wrote to memory of 1412	1508	CMD.exe	122
PID 2128 wrote to memory of 2828	2128	protected_Client.exe	123
PID 2828 wrote to memory of 408	2828	CMD.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\protected_Client.exe
"C:\Users\Admin\AppData\Local\Temp\protected_Client.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Zoom" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Zoom" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3188
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:780
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Cortana" /tr "C:\Users\Admin\AppData\Local\xdwdAutodesk AutoCAD Update.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Cortana" /tr "C:\Users\Admin\AppData\Local\xdwdAutodesk AutoCAD Update.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2372
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4436
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:672
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1656
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1412
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2336
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3348
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1084
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1392
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:788
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4716
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1192
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3008
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2912
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4448
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1232
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3228
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2416
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4380
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Roaming\xdwdOracle VirtualBox.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:640

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2128-0-0x0000000000C80000-0x0000000000D55000-memory.dmp

Download

memory/2128-2-0x0000000004DCA000-0x0000000004DCB000-memory.dmp

Download

memory/2128-3-0x000000001F720000-0x000000001F7B4000-memory.dmp

Download

memory/2128-4-0x0000000004600000-0x00000000050C2000-memory.dmp

Download

memory/2128-5-0x0000000004600000-0x00000000050C2000-memory.dmp

Download

memory/2128-6-0x0000000004600000-0x00000000050C2000-memory.dmp

Download

memory/2128-7-0x0000000004600000-0x00000000050C2000-memory.dmp

Download

memory/2128-8-0x0000000001150000-0x000000000120D000-memory.dmp

Download

memory/2128-10-0x00000000017F0000-0x0000000001881000-memory.dmp

Download

memory/2128-9-0x00000000013A0000-0x0000000001714000-memory.dmp

Download

memory/2128-14-0x0000000001C00000-0x0000000001C29000-memory.dmp

Download

memory/2128-16-0x0000000001D10000-0x0000000001DAE000-memory.dmp

Download

memory/2128-18-0x0000000001ED0000-0x0000000001FE2000-memory.dmp

Download

memory/2128-23-0x0000000003B30000-0x0000000003BDC000-memory.dmp

Download

memory/2128-22-0x0000000003AE0000-0x0000000003B22000-memory.dmp

Download

memory/2128-21-0x00000000023C0000-0x00000000023F1000-memory.dmp

Download

memory/2128-20-0x0000000002090000-0x00000000021A1000-memory.dmp

Download

memory/2128-19-0x0000000001FF0000-0x000000000208D000-memory.dmp

Download

memory/2128-15-0x0000000001C60000-0x0000000001D03000-memory.dmp

Download

memory/2128-11-0x0000000001890000-0x0000000001A3C000-memory.dmp

Download

memory/2128-17-0x0000000001DB0000-0x0000000001ED0000-memory.dmp

Download

memory/2128-12-0x0000000001A50000-0x0000000001AFE000-memory.dmp

Download

memory/2128-13-0x0000000001250000-0x0000000001276000-memory.dmp

Download

memory/2128-24-0x0000000003C10000-0x0000000003F88000-memory.dmp

Download

memory/2128-28-0x0000000004090000-0x00000000040A8000-memory.dmp

Download

memory/2128-36-0x0000000005430000-0x000000000546D000-memory.dmp

Download

memory/2128-37-0x000000001F7B0000-0x000000001F8FF000-memory.dmp

Download

memory/2128-49-0x0000000021E50000-0x0000000021E9C000-memory.dmp

Download

memory/2128-53-0x0000000022380000-0x00000000223E7000-memory.dmp

Download

memory/2128-50-0x0000000021EA0000-0x000000002230C000-memory.dmp

Download

memory/2128-56-0x0000000022560000-0x000000002256B000-memory.dmp

Download

memory/2128-57-0x0000000022570000-0x0000000022D1E000-memory.dmp

Download

memory/2128-65-0x0000000023960000-0x0000000023981000-memory.dmp

Download

memory/2128-59-0x0000000023590000-0x00000000236F6000-memory.dmp

Download

memory/2128-58-0x0000000022D20000-0x0000000023587000-memory.dmp

Download

memory/2128-64-0x0000000023950000-0x000000002395C000-memory.dmp

Download

memory/2128-63-0x0000000023910000-0x0000000023945000-memory.dmp

Download

memory/2128-62-0x0000000023830000-0x0000000023848000-memory.dmp

Download

memory/2128-61-0x0000000023800000-0x0000000023827000-memory.dmp

Download

memory/2128-60-0x0000000023700000-0x00000000237EA000-memory.dmp

Download

memory/2128-55-0x000000001F4F0000-0x000000001F502000-memory.dmp

Download

memory/2128-54-0x00000000223F0000-0x0000000022552000-memory.dmp

Download

memory/2128-52-0x0000000022350000-0x000000002237C000-memory.dmp

Download

memory/2128-51-0x0000000022310000-0x0000000022344000-memory.dmp

Download

memory/2128-48-0x0000000021E10000-0x0000000021E43000-memory.dmp

Download

memory/2128-47-0x0000000021DE0000-0x0000000021E06000-memory.dmp

Download

memory/2128-46-0x0000000021BE0000-0x0000000021C82000-memory.dmp

Download

memory/2128-45-0x000000001F4E0000-0x000000001F4E8000-memory.dmp

Download

memory/2128-44-0x00000000219E0000-0x0000000021ADA000-memory.dmp

Download

memory/2128-39-0x00000000055C0000-0x00000000055E4000-memory.dmp

Download

memory/2128-43-0x000000001F4C0000-0x000000001F4D4000-memory.dmp

Download

memory/2128-42-0x0000000005600000-0x0000000005630000-memory.dmp

Download

memory/2128-41-0x00000000055F0000-0x0000000005600000-memory.dmp

Download

memory/2128-40-0x0000000021550000-0x00000000215D2000-memory.dmp

Download

memory/2128-38-0x00000000214A0000-0x000000002154F000-memory.dmp

Download

memory/2128-35-0x00000000050F0000-0x00000000051AD000-memory.dmp

Download

memory/2128-29-0x0000000004370000-0x00000000043EF000-memory.dmp

Download

memory/2128-31-0x00000000044A0000-0x000000000454A000-memory.dmp

Download

memory/2128-30-0x00000000043F0000-0x0000000004457000-memory.dmp

Download

memory/2128-27-0x00000000041D0000-0x000000000436A000-memory.dmp

Download

memory/2128-34-0x00000000050D0000-0x00000000050E6000-memory.dmp

Download

memory/2128-33-0x0000000004580000-0x00000000045DD000-memory.dmp

Download

memory/2128-26-0x00000000040F0000-0x00000000041C6000-memory.dmp

Download

memory/2128-25-0x0000000003BE0000-0x0000000003BFD000-memory.dmp

Download

memory/2128-132-0x00000000013A0000-0x0000000001714000-memory.dmp

Download

memory/2128-138-0x0000000001C60000-0x0000000001D03000-memory.dmp

Download

memory/2128-137-0x0000000001C00000-0x0000000001C29000-memory.dmp

Download

memory/2128-135-0x0000000001A50000-0x0000000001AFE000-memory.dmp

Download

memory/2128-134-0x0000000001890000-0x0000000001A3C000-memory.dmp

Download

memory/2128-131-0x0000000001150000-0x000000000120D000-memory.dmp

Download

memory/2128-246-0x0000000026A30000-0x0000000026B76000-memory.dmp

Download

memory/2128-245-0x00000000269B0000-0x0000000026A26000-memory.dmp

Download

memory/2128-297-0x0000000026280000-0x000000002629E000-memory.dmp

Download