sheetrat | 1cfa56f381db0772f333be9e1a392335dbc5620816db08abfedf19d267d683b8

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a55fddv3rtr3dyu.exe
Size 181KB
Sample260820-kffpcssgpg
SHA256 1cfa56f381db0772f333be9e1a392335dbc5620816db08abfedf19d267d683b8
MD5 c2e1317c84a39e4d3a4f95c2a10b1f04
SHA1 368e0871058f827f8b6ed170eaa6d13485c3c2b9
SHA512 696a4ff3367451b4b42d7e3bf52e1f4d86e6c8242ad337eeb8f2f69838ac640eff1d261bba07d59769a858daa234728692cab9977508e35923b977bdce993005
SSDEEP 3072:4EHhcdL0mpSDB+wg0UREHX9Zd6DIZspoSznc1YxC2DqMhOblFeOHEG0:OBjyBkE35QIkv33DqMwb9
TLSH
T15804E00077844A62CB5FA6BD63A59300D235B3B74856C74BBDCB9CE031933CA9B16DDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

dasdasdadfs-60695.portmap.host:60695

Mutex

pfpcghdoh

Attributes

anti_virtual
false
certificate
trnhkkv0fivy1l55ffeg4
exclusion_wd
false
hidden_file
true
install
true
install_watch_dog
false
key
x0de1pok0nz4jpivrl
path_client
%Windows%\xdwd
pump
true
rootkit
4rjbi22n00do1x29n3l50bukdgo
use_install_admin
false
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/5016-0-0x0000000000A50000-0x0000000000A82000-memory.dmp	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwd"	2a55fddv3rtr3dyu.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 13 IoCs

pid	Process
1044	xdwd
3852	xdwd
1844	xdwd
3760	xdwd
1588	xdwd
3828	xdwd
1404	xdwd
3968	xdwd
3944	xdwd
3368	xdwd
4004	xdwd
532	xdwd
736	xdwd

Loads dropped DLL 53 IoCs

pid	Process
1044	xdwd
2504	Process not Found
116	Process not Found
1448	Process not Found
3168	Process not Found
1532	Process not Found
1628	Process not Found
4332	Process not Found
3736	Process not Found
728	Process not Found
3508	Process not Found
4948	Process not Found
2728	Process not Found
4316	Process not Found
2592	Process not Found
996	Process not Found
1848	Process not Found
3852	xdwd
1844	xdwd
3760	xdwd
1588	xdwd
3828	xdwd
3968	xdwd
1404	xdwd
3944	xdwd
3368	xdwd
4004	xdwd
532	xdwd
736	xdwd
3216	Process not Found
3804	Process not Found
4392	Process not Found
764	Process not Found
4680	Process not Found
4984	Process not Found
1496	Process not Found
4292	Process not Found
4968	Process not Found
2556	Process not Found
2144	Process not Found
4160	Process not Found
732	Process not Found
1036	Process not Found
2072	Process not Found
4988	Process not Found
4452	Process not Found
3804	Process not Found
4444	Process not Found
512	Process not Found
3680	Process not Found
3136	Process not Found
4804	Process not Found
4480	Process not Found

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	2a55fddv3rtr3dyu.exe
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File created	C:\Windows\xdwd	2a55fddv3rtr3dyu.exe
File opened for modification	C:\Windows\xdwd	2a55fddv3rtr3dyu.exe
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd.dll	2a55fddv3rtr3dyu.exe
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 36 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2024	cmd.exe
1788	cmd.exe
5116	cmd.exe
3536	cmd.exe
3372	cmd.exe
4772	cmd.exe
4340	cmd.exe
4840	cmd.exe
3296	cmd.exe
2812	cmd.exe
3800	cmd.exe
2832	cmd.exe
628	cmd.exe
2308	cmd.exe
4812	cmd.exe
316	cmd.exe
996	cmd.exe
4908	cmd.exe
868	cmd.exe
4132	cmd.exe
4872	cmd.exe
5020	cmd.exe
4704	cmd.exe
4856	cmd.exe
3816	cmd.exe
5096	cmd.exe
4624	cmd.exe
4316	cmd.exe
3616	cmd.exe
3808	cmd.exe
4976	cmd.exe
3980	cmd.exe
3988	cmd.exe
2020	cmd.exe
2224	cmd.exe
4964	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4416	schtasks.exe
440	schtasks.exe
1748	schtasks.exe
680	schtasks.exe
2140	schtasks.exe
4456	schtasks.exe
3612	schtasks.exe
5008	schtasks.exe
2696	schtasks.exe
1276	schtasks.exe
4456	schtasks.exe
964	schtasks.exe
2452	schtasks.exe
60	schtasks.exe
3488	schtasks.exe
3424	schtasks.exe
2388	schtasks.exe
4748	schtasks.exe
2652	schtasks.exe
4124	schtasks.exe
4116	schtasks.exe
4404	schtasks.exe
4444	schtasks.exe
5008	schtasks.exe
4204	schtasks.exe
1120	schtasks.exe
1304	schtasks.exe
1100	schtasks.exe
2020	schtasks.exe
2728	schtasks.exe
1476	schtasks.exe
4016	schtasks.exe
1196	schtasks.exe
3168	schtasks.exe
3972	schtasks.exe
4280	schtasks.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	2a55fddv3rtr3dyu.exe
Token: SeDebugPrivilege	1044	xdwd
Token: SeIncBasePriorityPrivilege	1044	xdwd
Token: SeDebugPrivilege	3852	xdwd
Token: SeDebugPrivilege	1844	xdwd
Token: SeDebugPrivilege	3760	xdwd
Token: SeDebugPrivilege	1588	xdwd
Token: SeDebugPrivilege	3828	xdwd
Token: SeDebugPrivilege	3968	xdwd
Token: SeDebugPrivilege	3368	xdwd
Token: SeDebugPrivilege	4004	xdwd
Token: SeDebugPrivilege	736	xdwd
Token: SeDebugPrivilege	532	xdwd
Token: SeDebugPrivilege	3944	xdwd
Token: SeDebugPrivilege	1404	xdwd

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3764	5016	2a55fddv3rtr3dyu.exe	86
PID 5016 wrote to memory of 628	5016	2a55fddv3rtr3dyu.exe	87
PID 628 wrote to memory of 2388	628	cmd.exe	90
PID 1044 wrote to memory of 5096	1044	xdwd	93
PID 5096 wrote to memory of 2452	5096	cmd.exe	95
PID 1044 wrote to memory of 316	1044	xdwd	96
PID 316 wrote to memory of 5008	316	cmd.exe	98
PID 1044 wrote to memory of 2024	1044	xdwd	102
PID 2024 wrote to memory of 2696	2024	cmd.exe	104
PID 1044 wrote to memory of 4872	1044	xdwd	106
PID 4872 wrote to memory of 3972	4872	cmd.exe	108
PID 1044 wrote to memory of 5020	1044	xdwd	111
PID 5020 wrote to memory of 4116	5020	cmd.exe	113
PID 1044 wrote to memory of 4704	1044	xdwd	114
PID 4704 wrote to memory of 60	4704	cmd.exe	116
PID 1044 wrote to memory of 3372	1044	xdwd	117
PID 3372 wrote to memory of 1304	3372	cmd.exe	119
PID 1044 wrote to memory of 1788	1044	xdwd	120
PID 1788 wrote to memory of 1100	1788	cmd.exe	122
PID 1044 wrote to memory of 4772	1044	xdwd	123
PID 4772 wrote to memory of 4404	4772	cmd.exe	125
PID 1044 wrote to memory of 3980	1044	xdwd	126
PID 3980 wrote to memory of 4748	3980	cmd.exe	128
PID 1044 wrote to memory of 2308	1044	xdwd	129
PID 2308 wrote to memory of 2020	2308	cmd.exe	131
PID 1044 wrote to memory of 3800	1044	xdwd	132
PID 3800 wrote to memory of 4456	3800	cmd.exe	134
PID 1044 wrote to memory of 2832	1044	xdwd	147
PID 2832 wrote to memory of 4204	2832	cmd.exe	149
PID 3852 wrote to memory of 3988	3852	xdwd	150
PID 3828 wrote to memory of 4624	3828	xdwd	152
PID 1844 wrote to memory of 5116	1844	xdwd	153
PID 3760 wrote to memory of 4856	3760	xdwd	154
PID 3988 wrote to memory of 2728	3988	cmd.exe	158
PID 5116 wrote to memory of 3612	5116	cmd.exe	159
PID 4624 wrote to memory of 1276	4624	cmd.exe	160
PID 4856 wrote to memory of 4444	4856	cmd.exe	161
PID 1588 wrote to memory of 4316	1588	xdwd	162
PID 4004 wrote to memory of 3616	4004	xdwd	164
PID 736 wrote to memory of 3808	736	xdwd	163
PID 3968 wrote to memory of 4976	3968	xdwd	168
PID 532 wrote to memory of 996	532	xdwd	172
PID 1404 wrote to memory of 3296	1404	xdwd	170
PID 3944 wrote to memory of 2812	3944	xdwd	171
PID 3368 wrote to memory of 2020	3368	xdwd	169
PID 3616 wrote to memory of 1476	3616	cmd.exe	179
PID 4316 wrote to memory of 4016	4316	cmd.exe	180
PID 3808 wrote to memory of 5008	3808	cmd.exe	178
PID 2020 wrote to memory of 2652	2020	cmd.exe	181
PID 2812 wrote to memory of 3488	2812	cmd.exe	182
PID 996 wrote to memory of 4280	996	cmd.exe	183
PID 3296 wrote to memory of 4456	3296	cmd.exe	184
PID 4976 wrote to memory of 4124	4976	cmd.exe	185
PID 1044 wrote to memory of 4812	1044	xdwd	186
PID 4812 wrote to memory of 1196	4812	cmd.exe	188
PID 1044 wrote to memory of 4340	1044	xdwd	189
PID 4340 wrote to memory of 964	4340	cmd.exe	191
PID 1044 wrote to memory of 3816	1044	xdwd	192
PID 3816 wrote to memory of 4416	3816	cmd.exe	194
PID 1044 wrote to memory of 4840	1044	xdwd	196
PID 4840 wrote to memory of 440	4840	cmd.exe	198
PID 1044 wrote to memory of 4908	1044	xdwd	199
PID 4908 wrote to memory of 1120	4908	cmd.exe	201
PID 1044 wrote to memory of 3536	1044	xdwd	202

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2a55fddv3rtr3dyu.exe
"C:\Users\Admin\AppData\Local\Temp\2a55fddv3rtr3dyu.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name=":G|W;@5(;|/i;k" dir=in action=allow program="C:\Windows\xdwd" enable=yes & exit
  2⤵
  PID:3764
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2388

C:\Windows\xdwd
C:\Windows\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2452
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2696
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3972
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4116
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:60
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1304
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1100
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4404
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4748
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2020
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4456
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4204
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1196
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:964
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4416
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:440
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1120
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3536
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3424
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2224
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3168
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4964
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1748
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:868
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:680
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4132
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2140

C:\Windows\xdwd
C:\Windows\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2728

C:\Windows\xdwd
C:\Windows\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3612

C:\Windows\xdwd
C:\Windows\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4444

C:\Windows\xdwd
C:\Windows\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4016

C:\Windows\xdwd
C:\Windows\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1276

C:\Windows\xdwd
C:\Windows\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4456

C:\Windows\xdwd
C:\Windows\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4124

C:\Windows\xdwd
C:\Windows\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3488

C:\Windows\xdwd
C:\Windows\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2652

C:\Windows\xdwd
C:\Windows\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1476

C:\Windows\xdwd
C:\Windows\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4280

C:\Windows\xdwd
C:\Windows\xdwd
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwd.log
Size 642B
SHA256 f9481e31897c3d9071b744e1638942b52c46858c16ccf692f5c6e109a8b092f6
MD5 e19ed69089e56bbfaaba5e5e63d0354f
SHA1 287519bf7c4ec630e4326db00809f627f927ebef
SHA512 c4a8678d28eea4c3a3adfe0324943478efabef839d3bdacb0e4c278e97ee356037c0bfd83b096952b43d81af0b7253eb7d666416e0024ce93a1c516a834fd05b
TLSH
T18EF078313365E2D889663F16282C268803BF4765E690EE0C7594A2AED9365235F212E7
MD5 SHA1 SHA512 TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1044-70-0x0000000000D90000-0x0000000000DA2000-memory.dmp

Download

memory/1044-106-0x0000000000EE0000-0x0000000000FAA000-memory.dmp

Download

memory/5016-0-0x0000000000A50000-0x0000000000A82000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads