sheetrat | a52ae34812b813d8632b3c028c540b52dbdbac0cc7507ca320356da0391b0ca4

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 577KB
Sample260820-maydbsvbqc
SHA256 a52ae34812b813d8632b3c028c540b52dbdbac0cc7507ca320356da0391b0ca4
MD5 a9f64efb678a853421bf38de6c7db3fa
SHA1 d882d5485f0cf1951ebbd74054efaffdc63894a4
SHA512 4cefe8c787f0f47e5312f41600d71fa39ca8fb33a8c6c0183df50c01f58e1fda0a077c9fd5eb1f493eecf93f75fee4f90ac3fd11fdd3b766694fa0cc6f6da890
SSDEEP 12288:FI2/nUBL6VOYPVle8wxUCzqX29HZ6rJsaXL:F816OvUC0MZ
TLSH
T1DFC4910CFE91E805CE1E3DB7CFEA11004B7165C1AE1186562119AFFE8BA63B359E257C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_jopgvsyyoknuzv discovery execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_jopgvsyyoknuzv

dasdasdadfs-60695.portmap.host:60695

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/4004-0-0x00000000000A0000-0x0000000000136000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral2/memory/4004-0-0x00000000000A0000-0x0000000000136000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\Documents\\xdwdTrello.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2928	xdwdTrello.exe

Loads dropped DLL 50 IoCs

pid	Process
5496	Process not Found
4864	Process not Found
996	Process not Found
3040	Process not Found
6052	Process not Found
2632	Process not Found
4944	Process not Found
6084	WmiApSrv.exe
5180	Process not Found
2628	Process not Found
2648	Process not Found
2928	xdwdTrello.exe
3844	Process not Found
3068	Process not Found
5008	Process not Found
5200	Process not Found
1488	Process not Found
3796	Process not Found
1108	Process not Found
4600	Process not Found
3828	Process not Found
3024	Process not Found
3428	Process not Found
4944	Process not Found
5824	Process not Found
3228	Process not Found
1360	Process not Found
1480	Process not Found
1876	Process not Found
720	Process not Found
4620	Process not Found
4924	Process not Found
4748	Process not Found
5424	Process not Found
1540	Process not Found
4976	Process not Found
5728	Process not Found
5856	Process not Found
4288	Process not Found
5852	Process not Found
2996	Process not Found
3108	Process not Found
2656	Process not Found
5376	Process not Found
3872	Process not Found
4944	Process not Found
1512	Process not Found
5896	Process not Found
2468	Process not Found
572	Process not Found

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\xdwdMicrosoft Power BI.exe	Client.exe
File opened for modification	C:\Windows\xdwdMicrosoft Power BI.exe	Client.exe
File created	C:\Windows\xdwd.dll	Client.exe
File opened for modification	C:\Windows\xdwdMicrosoft Power BI.exe	xdwdTrello.exe

Executes a command shell one-liner 1 TTPs 45 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1172	CMD.exe
2588	CMD.exe
764	CMD.exe
3332	CMD.exe
4320	CMD.exe
5620	CMD.exe
5212	CMD.exe
2628	CMD.exe
4468	CMD.exe
4156	CMD.exe
3476	CMD.exe
5224	CMD.exe
1976	CMD.exe
1368	CMD.exe
5624	CMD.exe
4240	CMD.exe
4912	CMD.exe
2660	CMD.exe
800	CMD.exe
3028	CMD.exe
2828	CMD.exe
3240	CMD.exe
4372	CMD.exe
4672	CMD.exe
4832	CMD.exe
4876	CMD.exe
1072	CMD.exe
3676	CMD.exe
1780	CMD.exe
6036	CMD.exe
984	CMD.exe
5272	CMD.exe
4932	CMD.exe
4116	CMD.exe
6016	CMD.exe
1520	CMD.exe
3636	CMD.exe
5988	CMD.exe
1108	CMD.exe
4676	CMD.exe
2832	CMD.exe
2188	CMD.exe
3012	CMD.exe
4440	CMD.exe
992	CMD.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4952	schtasks.exe
4824	schtasks.exe
2220	schtasks.exe
3472	schtasks.exe
4724	schtasks.exe
432	schtasks.exe
5020	schtasks.exe
724	schtasks.exe
240	schtasks.exe
5732	schtasks.exe
4856	schtasks.exe
2120	schtasks.exe
5412	schtasks.exe
2112	schtasks.exe
912	schtasks.exe
1244	schtasks.exe
1144	schtasks.exe
1508	schtasks.exe
1088	schtasks.exe
1500	schtasks.exe
5660	schtasks.exe
1080	schtasks.exe
5916	schtasks.exe
3956	schtasks.exe
1244	schtasks.exe
5852	schtasks.exe
2148	schtasks.exe
3100	schtasks.exe
3008	schtasks.exe
4916	schtasks.exe
4584	schtasks.exe
1488	schtasks.exe
4260	schtasks.exe
5860	schtasks.exe
5420	schtasks.exe
5768	schtasks.exe
4720	schtasks.exe
5716	schtasks.exe
2104	schtasks.exe
1972	schtasks.exe
5460	schtasks.exe
4688	schtasks.exe
5896	schtasks.exe
428	schtasks.exe
4520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
4004	Client.exe
6084	WmiApSrv.exe
6084	WmiApSrv.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	Client.exe
Token: SeDebugPrivilege	2928	xdwdTrello.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 5988	4004	Client.exe	90
PID 5988 wrote to memory of 5020	5988	CMD.exe	92
PID 4004 wrote to memory of 4320	4004	Client.exe	93
PID 4320 wrote to memory of 1972	4320	CMD.exe	95
PID 4004 wrote to memory of 3476	4004	Client.exe	96
PID 3476 wrote to memory of 1500	3476	CMD.exe	98
PID 4004 wrote to memory of 2188	4004	Client.exe	103
PID 2188 wrote to memory of 5460	2188	CMD.exe	105
PID 4004 wrote to memory of 3012	4004	Client.exe	106
PID 3012 wrote to memory of 5412	3012	CMD.exe	108
PID 4004 wrote to memory of 5620	4004	Client.exe	112
PID 5620 wrote to memory of 1244	5620	CMD.exe	114
PID 4004 wrote to memory of 6036	4004	Client.exe	115
PID 6036 wrote to memory of 5660	6036	CMD.exe	117
PID 4004 wrote to memory of 4876	4004	Client.exe	119
PID 4876 wrote to memory of 4260	4876	CMD.exe	121
PID 4004 wrote to memory of 4440	4004	Client.exe	122
PID 4440 wrote to memory of 724	4440	CMD.exe	124
PID 4004 wrote to memory of 4116	4004	Client.exe	125
PID 4116 wrote to memory of 5860	4116	CMD.exe	127
PID 4004 wrote to memory of 1072	4004	Client.exe	128
PID 1072 wrote to memory of 2112	1072	CMD.exe	130
PID 2928 wrote to memory of 800	2928	xdwdTrello.exe	131
PID 800 wrote to memory of 1080	800	CMD.exe	133
PID 4004 wrote to memory of 3676	4004	Client.exe	134
PID 3676 wrote to memory of 5852	3676	CMD.exe	136
PID 2928 wrote to memory of 3028	2928	xdwdTrello.exe	137
PID 3028 wrote to memory of 240	3028	CMD.exe	139
PID 4004 wrote to memory of 5224	4004	Client.exe	140
PID 5224 wrote to memory of 5420	5224	CMD.exe	142
PID 4004 wrote to memory of 1976	4004	Client.exe	143
PID 1976 wrote to memory of 5732	1976	CMD.exe	145
PID 4004 wrote to memory of 1368	4004	Client.exe	146
PID 1368 wrote to memory of 4688	1368	CMD.exe	148
PID 4004 wrote to memory of 2828	4004	Client.exe	149
PID 2828 wrote to memory of 912	2828	CMD.exe	151
PID 4004 wrote to memory of 5624	4004	Client.exe	152
PID 5624 wrote to memory of 2148	5624	CMD.exe	154
PID 4004 wrote to memory of 5212	4004	Client.exe	155
PID 5212 wrote to memory of 5916	5212	CMD.exe	157
PID 4004 wrote to memory of 4240	4004	Client.exe	158
PID 4240 wrote to memory of 5896	4240	CMD.exe	160
PID 4004 wrote to memory of 992	4004	Client.exe	161
PID 992 wrote to memory of 1244	992	CMD.exe	163
PID 4004 wrote to memory of 2628	4004	Client.exe	164
PID 2628 wrote to memory of 3100	2628	CMD.exe	166
PID 4004 wrote to memory of 4912	4004	Client.exe	167
PID 4912 wrote to memory of 5768	4912	CMD.exe	169
PID 4004 wrote to memory of 984	4004	Client.exe	170
PID 984 wrote to memory of 3008	984	CMD.exe	172
PID 4004 wrote to memory of 6016	4004	Client.exe	173
PID 6016 wrote to memory of 4824	6016	CMD.exe	175
PID 4004 wrote to memory of 1172	4004	Client.exe	176
PID 1172 wrote to memory of 2220	1172	CMD.exe	178
PID 4004 wrote to memory of 4832	4004	Client.exe	179
PID 4832 wrote to memory of 4856	4832	CMD.exe	181
PID 4004 wrote to memory of 2660	4004	Client.exe	182
PID 2660 wrote to memory of 4720	2660	CMD.exe	184
PID 4004 wrote to memory of 4468	4004	Client.exe	185
PID 4468 wrote to memory of 5716	4468	CMD.exe	187
PID 4004 wrote to memory of 5272	4004	Client.exe	188
PID 5272 wrote to memory of 4916	5272	CMD.exe	190
PID 4004 wrote to memory of 1520	4004	Client.exe	191
PID 1520 wrote to memory of 2120	1520	CMD.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Avast Antivirus" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Avast Antivirus" /tr "C:\Users\Admin\Documents\xdwdTrello.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Visual Studio Code Host" /tr "C:\Windows\xdwdMicrosoft Power BI.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Visual Studio Code Host" /tr "C:\Windows\xdwdMicrosoft Power BI.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1500
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5460
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5412
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5660
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4260
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2112
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5852
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5420
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5732
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:912
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2148
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4856
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5716
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2120
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4584
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3240
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:428
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1144
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:764
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4156
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3332
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4372
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2104
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1780
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3636
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4672
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3956

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:6084

C:\Users\Admin\Documents\xdwdTrello.exe
C:\Users\Admin\Documents\xdwdTrello.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1080
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Users\Admin\Documents\xdwdTrello.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4004-127-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/4004-188-0x0000000000A60000-0x0000000000A7E000-memory.dmp

Download

memory/4004-3-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/4004-4-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/4004-5-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/4004-37-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/4004-2-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp

Download

memory/4004-186-0x000000001B940000-0x000000001B9B6000-memory.dmp

Download

memory/4004-0-0x00000000000A0000-0x0000000000136000-memory.dmp

Download

memory/4004-187-0x0000000000A20000-0x0000000000A2C000-memory.dmp

Download

memory/4004-1-0x00007FFC6D6AF000-0x00007FFC6D6B0000-memory.dmp

Download

memory/4004-226-0x0000000000A40000-0x0000000000A48000-memory.dmp

Download

memory/4004-228-0x0000000002430000-0x0000000002442000-memory.dmp

Download

memory/4004-245-0x000000001C040000-0x000000001C186000-memory.dmp

Download

memory/4004-248-0x0000000002410000-0x000000000241A000-memory.dmp

Download