sheetrat | 12db90db649196dc4a000c054e72134bb2edc4d60a9f5237a0bc600b3dad536d

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Exloader.exe
Size 333KB
Sample260820-ve34dafp4x
SHA256 12db90db649196dc4a000c054e72134bb2edc4d60a9f5237a0bc600b3dad536d
MD5 9ae194254764d9bc95a83fd710ebe138
SHA1 d9dfbd66a53274c197e9e0b03740b11c6c0be92a
SHA512 1b32c1ad3cad9b23ce892b4111fb5c96d76162c0c56a9a3bfdf0526422cee90c1e8cb68749b113604fae1ff54a03e6f32fd6fa0e8b742df1b7c29a4c3f5a24bb
SSDEEP 6144:qFhLoQ5xlgLgvV39abFeAuAhVIZxwKreRBF:CLfxlgGt9GeAjhmpinF
TLSH
T1CC74025CBF8A4E42C3CE0B79745A93595271E3C7669BD74AE70A92C97EC3204D8038E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

dasdasdadfs-60695.portmap.host:60695

Mutex

neverlol

Attributes

anti_virtual
false
certificate
22zlwdgi
exclusion_wd
false
hidden_file
true
install
true
install_watch_dog
false
key
7p5iouane1kgthge7p2xp4
path_client
%Windows%\xdwd
pump
true
rootkit
1hhbtzexmcg9u5junmwjh25dgc9sbe
use_install_admin
true
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/4624-1-0x0000000000510000-0x0000000000566000-memory.dmp	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwd"	Exloader.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 10 IoCs

pid	Process
4176	xdwd
4648	xdwd
4740	xdwd
4680	xdwd
3020	xdwd
5688	xdwd
5320	xdwd
5348	xdwd
3056	xdwd
6000	xdwd

Loads dropped DLL 36 IoCs

pid	Process
4176	xdwd
1788	Process not Found
2916	Process not Found
3420	Process not Found
4864	Process not Found
844	Process not Found
4328	Process not Found
2436	Process not Found
912	Process not Found
5924	Process not Found
5008	Process not Found
4648	xdwd
4740	xdwd
4680	xdwd
3020	xdwd
5688	xdwd
5320	xdwd
3056	xdwd
5348	xdwd
6000	xdwd
4068	Process not Found
5512	Process not Found
1156	Process not Found
2484	Process not Found
4280	Process not Found
5516	Process not Found
1848	Process not Found
5880	Process not Found
3440	Process not Found
5808	Process not Found
1128	Process not Found
1352	Process not Found
5400	Process not Found
4620	Process not Found
5976	Process not Found
1696	Process not Found

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Exloader.exe
File opened for modification	C:\Windows\xdwd.dll	Exloader.exe
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File created	C:\Windows\xdwd	Exloader.exe
File opened for modification	C:\Windows\xdwd	Exloader.exe
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd
File opened for modification	C:\Windows\xdwd	xdwd

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 27 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4892	cmd.exe
1744	cmd.exe
4256	cmd.exe
2980	cmd.exe
4336	cmd.exe
5100	cmd.exe
1760	cmd.exe
1180	cmd.exe
5864	cmd.exe
3484	cmd.exe
1464	cmd.exe
4840	cmd.exe
4708	cmd.exe
2500	cmd.exe
3444	cmd.exe
1692	cmd.exe
3952	cmd.exe
4928	cmd.exe
4556	cmd.exe
5616	cmd.exe
3480	cmd.exe
2208	cmd.exe
5944	cmd.exe
5828	cmd.exe
3112	cmd.exe
4564	cmd.exe
4380	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4632	schtasks.exe
6036	schtasks.exe
5996	schtasks.exe
1124	schtasks.exe
4792	schtasks.exe
2944	schtasks.exe
4408	schtasks.exe
2840	schtasks.exe
1548	schtasks.exe
5872	schtasks.exe
5656	schtasks.exe
2792	schtasks.exe
2788	schtasks.exe
1256	schtasks.exe
2856	schtasks.exe
2816	schtasks.exe
2104	schtasks.exe
5092	schtasks.exe
5420	schtasks.exe
1816	schtasks.exe
2068	schtasks.exe
784	schtasks.exe
2904	schtasks.exe
564	schtasks.exe
4252	schtasks.exe
1072	schtasks.exe
4772	schtasks.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	Exloader.exe
Token: SeDebugPrivilege	4176	xdwd
Token: SeIncBasePriorityPrivilege	4176	xdwd
Token: SeDebugPrivilege	4648	xdwd
Token: SeDebugPrivilege	4740	xdwd
Token: SeDebugPrivilege	4680	xdwd
Token: SeDebugPrivilege	3020	xdwd
Token: SeDebugPrivilege	5688	xdwd
Token: SeDebugPrivilege	5320	xdwd
Token: SeDebugPrivilege	5348	xdwd
Token: SeDebugPrivilege	3056	xdwd
Token: SeDebugPrivilege	6000	xdwd

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4332	4624	Exloader.exe	90
PID 4624 wrote to memory of 3112	4624	Exloader.exe	91
PID 3112 wrote to memory of 2788	3112	cmd.exe	94
PID 4176 wrote to memory of 4564	4176	xdwd	97
PID 4564 wrote to memory of 2840	4564	cmd.exe	99
PID 4176 wrote to memory of 4928	4176	xdwd	100
PID 4928 wrote to memory of 1548	4928	cmd.exe	102
PID 4176 wrote to memory of 4380	4176	xdwd	103
PID 4380 wrote to memory of 4772	4380	cmd.exe	105
PID 4176 wrote to memory of 4556	4176	xdwd	106
PID 4556 wrote to memory of 1816	4556	cmd.exe	108
PID 4176 wrote to memory of 3484	4176	xdwd	109
PID 3484 wrote to memory of 1256	3484	cmd.exe	111
PID 4176 wrote to memory of 4892	4176	xdwd	112
PID 4892 wrote to memory of 2068	4892	cmd.exe	114
PID 4176 wrote to memory of 1464	4176	xdwd	115
PID 1464 wrote to memory of 5872	1464	cmd.exe	117
PID 4176 wrote to memory of 2980	4176	xdwd	118
PID 2980 wrote to memory of 5656	2980	cmd.exe	120
PID 4176 wrote to memory of 5616	4176	xdwd	121
PID 5616 wrote to memory of 2856	5616	cmd.exe	123
PID 4176 wrote to memory of 4840	4176	xdwd	124
PID 4840 wrote to memory of 2816	4840	cmd.exe	126
PID 4648 wrote to memory of 4708	4648	xdwd	136
PID 4708 wrote to memory of 784	4708	cmd.exe	138
PID 3020 wrote to memory of 2500	3020	xdwd	139
PID 4740 wrote to memory of 4336	4740	xdwd	141
PID 5688 wrote to memory of 3444	5688	xdwd	142
PID 4680 wrote to memory of 1692	4680	xdwd	145
PID 2500 wrote to memory of 2904	2500	cmd.exe	146
PID 4336 wrote to memory of 4632	4336	cmd.exe	148
PID 6000 wrote to memory of 3952	6000	xdwd	149
PID 3444 wrote to memory of 6036	3444	cmd.exe	151
PID 3056 wrote to memory of 1744	3056	xdwd	150
PID 1692 wrote to memory of 2792	1692	cmd.exe	154
PID 5348 wrote to memory of 3480	5348	xdwd	155
PID 4176 wrote to memory of 5100	4176	xdwd	156
PID 5100 wrote to memory of 5996	5100	cmd.exe	158
PID 1744 wrote to memory of 2104	1744	cmd.exe	161
PID 5320 wrote to memory of 1760	5320	xdwd	160
PID 3480 wrote to memory of 564	3480	cmd.exe	163
PID 3952 wrote to memory of 5092	3952	cmd.exe	164
PID 1760 wrote to memory of 1124	1760	cmd.exe	165
PID 4176 wrote to memory of 1180	4176	xdwd	166
PID 1180 wrote to memory of 4252	1180	cmd.exe	168
PID 4176 wrote to memory of 4256	4176	xdwd	169
PID 4256 wrote to memory of 4792	4256	cmd.exe	171
PID 4176 wrote to memory of 5864	4176	xdwd	172
PID 5864 wrote to memory of 1072	5864	cmd.exe	174
PID 4176 wrote to memory of 2208	4176	xdwd	175
PID 2208 wrote to memory of 2944	2208	cmd.exe	177
PID 4176 wrote to memory of 5944	4176	xdwd	178
PID 5944 wrote to memory of 5420	5944	cmd.exe	180
PID 4176 wrote to memory of 5828	4176	xdwd	181
PID 5828 wrote to memory of 4408	5828	cmd.exe	183

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Exloader.exe
"C:\Users\Admin\AppData\Local\Temp\Exloader.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="gWsKP57{PsRLPt" dir=in action=allow program="C:\Windows\xdwd" enable=yes & exit
  2⤵
  PID:4332
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2788

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2840
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1548
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4772
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1256
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2068
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5872
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5656
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2856
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5996
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4252
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4792
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1072
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2944
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5420
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4408

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:784

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4632

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2792

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2904

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6036

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1124

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5348
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:564

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2104

C:\Windows\xdwd
"C:\Windows\xdwd"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6000
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4624-0-0x00007FFB0BAEF000-0x00007FFB0BAF0000-memory.dmp

Download

memory/4624-1-0x0000000000510000-0x0000000000566000-memory.dmp

Download

memory/4624-2-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/4624-3-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/4624-4-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/4624-57-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads