sheetrat | 1cfa56f381db0772f333be9e1a392335dbc5620816db08abfedf19d267d683b8

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a55fddv3rtr3dyu.exe
Size 181KB
Sample260820-kffpcssgpg
SHA256 1cfa56f381db0772f333be9e1a392335dbc5620816db08abfedf19d267d683b8
MD5 c2e1317c84a39e4d3a4f95c2a10b1f04
SHA1 368e0871058f827f8b6ed170eaa6d13485c3c2b9
SHA512 696a4ff3367451b4b42d7e3bf52e1f4d86e6c8242ad337eeb8f2f69838ac640eff1d261bba07d59769a858daa234728692cab9977508e35923b977bdce993005
SSDEEP 3072:4EHhcdL0mpSDB+wg0UREHX9Zd6DIZspoSznc1YxC2DqMhOblFeOHEG0:OBjyBkE35QIkv33DqMwb9
TLSH
T15804E00077844A62CB5FA6BD63A59300D235B3B74856C74BBDCB9CE031933CA9B16DDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

dasdasdadfs-60695.portmap.host:60695

Mutex

pfpcghdoh

Attributes

anti_virtual
false
certificate
trnhkkv0fivy1l55ffeg4
exclusion_wd
false
hidden_file
true
install
true
install_watch_dog
false
key
x0de1pok0nz4jpivrl
path_client
%Windows%\xdwd
pump
true
rootkit
4rjbi22n00do1x29n3l50bukdgo
use_install_admin
false
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/4332-0-0x0000000000B20000-0x0000000000B52000-memory.dmp	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwd"	2a55fddv3rtr3dyu.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 11 IoCs

pid	Process
5676	xdwd
1584	xdwd
2956	xdwd
5452	xdwd
1812	xdwd
2152	xdwd
3800	xdwd
1552	xdwd
4860	xdwd
1872	xdwd
4460	xdwd

Loads dropped DLL 42 IoCs

pid	Process
5676	xdwd
3228	Process not Found
3804	Process not Found
4324	Process not Found
3000	Process not Found
1752	Process not Found
3908	Process not Found
5880	Process not Found
2832	Process not Found
2060	Process not Found
5788	Process not Found
1584	xdwd
2956	xdwd
5452	xdwd
1812	xdwd
2152	xdwd
3800	xdwd
1552	xdwd
4860	xdwd
1872	xdwd
4460	xdwd
4568	Process not Found
5240	Process not Found
3064	Process not Found
4040	Process not Found
1276	Process not Found
1204	Process not Found
2696	Process not Found
4924	Process not Found
4672	Process not Found
5004	Process not Found
3492	Process not Found
2648	Process not Found
2944	Process not Found
552	Process not Found
4520	Process not Found
3540	Process not Found
4792	Process not Found
4872	Process not Found
4604	Process not Found
4968	Process not Found
2580	Process not Found

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\xdwd	2a55fddv3rtr3dyu.exe
File created	C:\Windows\xdwd.dll	2a55fddv3rtr3dyu.exe
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	2a55fddv3rtr3dyu.exe
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd.dll	2a55fddv3rtr3dyu.exe
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 32 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2476	cmd.exe
4972	cmd.exe
1676	cmd.exe
4380	cmd.exe
5172	cmd.exe
5568	cmd.exe
3348	cmd.exe
4796	cmd.exe
1120	cmd.exe
4524	cmd.exe
3408	cmd.exe
3396	cmd.exe
2672	cmd.exe
3268	cmd.exe
4976	cmd.exe
5632	cmd.exe
4388	cmd.exe
5988	cmd.exe
3452	cmd.exe
4776	cmd.exe
3808	cmd.exe
5008	cmd.exe
5544	cmd.exe
3328	cmd.exe
2356	cmd.exe
4960	cmd.exe
4404	cmd.exe
1284	cmd.exe
824	cmd.exe
4536	cmd.exe
3632	cmd.exe
5744	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 32 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1964	schtasks.exe
4600	schtasks.exe
2488	schtasks.exe
4748	schtasks.exe
3748	schtasks.exe
5044	schtasks.exe
4324	schtasks.exe
2404	schtasks.exe
2844	schtasks.exe
3056	schtasks.exe
4688	schtasks.exe
3520	schtasks.exe
2764	schtasks.exe
2432	schtasks.exe
4936	schtasks.exe
2312	schtasks.exe
1172	schtasks.exe
1732	schtasks.exe
5968	schtasks.exe
4400	schtasks.exe
5488	schtasks.exe
5392	schtasks.exe
5700	schtasks.exe
4744	schtasks.exe
3216	schtasks.exe
3592	schtasks.exe
5204	schtasks.exe
4032	schtasks.exe
4544	schtasks.exe
2012	schtasks.exe
4196	schtasks.exe
5892	schtasks.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	2a55fddv3rtr3dyu.exe
Token: SeDebugPrivilege	5676	xdwd
Token: SeIncBasePriorityPrivilege	5676	xdwd
Token: SeDebugPrivilege	1584	xdwd
Token: SeDebugPrivilege	2956	xdwd
Token: SeDebugPrivilege	1812	xdwd
Token: SeDebugPrivilege	5452	xdwd
Token: SeDebugPrivilege	2152	xdwd
Token: SeDebugPrivilege	3800	xdwd
Token: SeDebugPrivilege	1872	xdwd
Token: SeDebugPrivilege	1552	xdwd
Token: SeDebugPrivilege	4860	xdwd
Token: SeDebugPrivilege	4460	xdwd

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 5620	4332	2a55fddv3rtr3dyu.exe	90
PID 4332 wrote to memory of 4536	4332	2a55fddv3rtr3dyu.exe	91
PID 4536 wrote to memory of 2312	4536	cmd.exe	94
PID 5676 wrote to memory of 4404	5676	xdwd	97
PID 4404 wrote to memory of 2432	4404	cmd.exe	99
PID 5676 wrote to memory of 1284	5676	xdwd	100
PID 1284 wrote to memory of 4744	1284	cmd.exe	102
PID 5676 wrote to memory of 3328	5676	xdwd	103
PID 3328 wrote to memory of 1172	3328	cmd.exe	105
PID 5676 wrote to memory of 5172	5676	xdwd	106
PID 5172 wrote to memory of 3216	5172	cmd.exe	108
PID 5676 wrote to memory of 4796	5676	xdwd	109
PID 4796 wrote to memory of 1964	4796	cmd.exe	111
PID 5676 wrote to memory of 3808	5676	xdwd	112
PID 3808 wrote to memory of 1732	3808	cmd.exe	114
PID 5676 wrote to memory of 3632	5676	xdwd	115
PID 3632 wrote to memory of 2012	3632	cmd.exe	117
PID 5676 wrote to memory of 5568	5676	xdwd	118
PID 5568 wrote to memory of 4600	5568	cmd.exe	120
PID 5676 wrote to memory of 3268	5676	xdwd	121
PID 3268 wrote to memory of 5968	3268	cmd.exe	123
PID 5676 wrote to memory of 2356	5676	xdwd	124
PID 2356 wrote to memory of 4196	2356	cmd.exe	126
PID 1584 wrote to memory of 4976	1584	xdwd	137
PID 4976 wrote to memory of 3056	4976	cmd.exe	139
PID 2956 wrote to memory of 5744	2956	xdwd	140
PID 1812 wrote to memory of 1120	1812	xdwd	142
PID 5744 wrote to memory of 4688	5744	cmd.exe	144
PID 5676 wrote to memory of 2476	5676	xdwd	145
PID 1120 wrote to memory of 2488	1120	cmd.exe	147
PID 2476 wrote to memory of 4400	2476	cmd.exe	148
PID 5452 wrote to memory of 4524	5452	xdwd	149
PID 4460 wrote to memory of 824	4460	xdwd	151
PID 1872 wrote to memory of 3348	1872	xdwd	150
PID 2152 wrote to memory of 4972	2152	xdwd	155
PID 3800 wrote to memory of 5632	3800	xdwd	154
PID 1552 wrote to memory of 4388	1552	xdwd	158
PID 4860 wrote to memory of 3408	4860	xdwd	159
PID 824 wrote to memory of 4324	824	cmd.exe	162
PID 4972 wrote to memory of 5488	4972	cmd.exe	164
PID 4388 wrote to memory of 3520	4388	cmd.exe	165
PID 5632 wrote to memory of 3592	5632	cmd.exe	166
PID 3408 wrote to memory of 4032	3408	cmd.exe	168
PID 4524 wrote to memory of 5204	4524	cmd.exe	167
PID 3348 wrote to memory of 4936	3348	cmd.exe	169
PID 5676 wrote to memory of 3396	5676	xdwd	170
PID 3396 wrote to memory of 2404	3396	cmd.exe	172
PID 5676 wrote to memory of 1676	5676	xdwd	173
PID 1676 wrote to memory of 2764	1676	cmd.exe	175
PID 5676 wrote to memory of 4776	5676	xdwd	176
PID 4776 wrote to memory of 5892	4776	cmd.exe	178
PID 5676 wrote to memory of 5988	5676	xdwd	179
PID 5988 wrote to memory of 4748	5988	cmd.exe	181
PID 5676 wrote to memory of 2672	5676	xdwd	182
PID 2672 wrote to memory of 5392	2672	cmd.exe	184
PID 5676 wrote to memory of 5008	5676	xdwd	185
PID 5008 wrote to memory of 5044	5008	cmd.exe	187
PID 5676 wrote to memory of 3452	5676	xdwd	188
PID 3452 wrote to memory of 5700	3452	cmd.exe	190
PID 5676 wrote to memory of 4960	5676	xdwd	191
PID 4960 wrote to memory of 2844	4960	cmd.exe	193
PID 5676 wrote to memory of 5544	5676	xdwd	194
PID 5544 wrote to memory of 4544	5544	cmd.exe	196
PID 5676 wrote to memory of 4380	5676	xdwd	197

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2a55fddv3rtr3dyu.exe
"C:\Users\Admin\AppData\Local\Temp\2a55fddv3rtr3dyu.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name=":G|W;@5(;|/i;k" dir=in action=allow program="C:\Windows\xdwd" enable=yes & exit
  2⤵
  PID:5620
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2312

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4744
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1172
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3216
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1964
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1732
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2012
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4600
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5968
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4196
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4400
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2404
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2764
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5892
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4748
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5392
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5044
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5700
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2844
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4544
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4380
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3748

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3056

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4688

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5204

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2488

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5488

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5632
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3592

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3520

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4032

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4936

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1552-122-0x0000000003280000-0x0000000003370000-memory.dmp

Download

memory/1584-105-0x00000000033A0000-0x0000000003490000-memory.dmp

Download

memory/1812-109-0x000000001D660000-0x000000001D750000-memory.dmp

Download

memory/1872-118-0x000000001D020000-0x000000001D110000-memory.dmp

Download

memory/2152-117-0x0000000002EA0000-0x0000000002F90000-memory.dmp

Download

memory/2956-108-0x000000001CEA0000-0x000000001CF90000-memory.dmp

Download

memory/3800-123-0x000000001CE20000-0x000000001CF10000-memory.dmp

Download

memory/4332-4-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4332-8-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4332-61-0x00000000036C0000-0x00000000037B0000-memory.dmp

Download

memory/4332-62-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4332-7-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4332-6-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4332-5-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4332-3-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4332-2-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4332-0-0x0000000000B20000-0x0000000000B52000-memory.dmp

Download

memory/4332-1-0x00007FF8EA99F000-0x00007FF8EA9A0000-memory.dmp

Download

memory/4460-114-0x000000001D060000-0x000000001D150000-memory.dmp

Download

memory/4860-124-0x0000000003450000-0x0000000003540000-memory.dmp

Download

memory/5452-113-0x000000001C800000-0x000000001C8F0000-memory.dmp

Download

memory/5676-77-0x000000001CAB0000-0x000000001CBA0000-memory.dmp

Download

memory/5676-74-0x000000001CAB0000-0x000000001CBA0000-memory.dmp

Download

memory/5676-71-0x000000001CAB0000-0x000000001CBA0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads