sheetrat | b55476f41ed05495b4b16cdfd490de1479ba8602cf7be3c4154b5542e1a6b657

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SSh_Client.exe
Size 552KB
Sample260822-p5krtsvbme
SHA256 b55476f41ed05495b4b16cdfd490de1479ba8602cf7be3c4154b5542e1a6b657
MD5 3412aa719b85ee1f9b4e8fe9111dbf0b
SHA1 2dfcfa61fe349d126994b8ccfed4f55b53b36dab
SHA512 33302439ddd1424e42eac5cea3cde847d38e9cb989c383a8b675266de8ce7fcc3ebe544d9937e7bab9db28181272ce389492bb88e5125970ed1fb683cb030c1a
SSDEEP 6144:Nl53yZFOb9gM06DCdaae6VlWT8b9MBRzj8KuVXdlVrb6VlPBEuy0:NXLffDIPVle8+YVNVH0
TLSH
T1DDC4D61CFE81E806CD1A3EB3CFE910049B7121C2AE2295563159AFFD87653B358E667C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

bualcvtjsr.localto.net:3425

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/4612-1-0x0000000000350000-0x00000000003DE000-memory.dmp	family_sheetrat_v4
behavioral2/files/0x00030000000170b9-11.dat	family_sheetrat_v4

Detects Sheetrat obfuscated version 2 IoCs

resource	yara_rule
behavioral2/memory/4612-1-0x0000000000350000-0x00000000003DE000-memory.dmp	Sheetrat_v5
behavioral2/files/0x00030000000170b9-11.dat	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\svchost.exe"	SSh_Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 2 IoCs

pid	Process
3396	svchost.exe
1676	System32.exe

Loads dropped DLL 50 IoCs

pid	Process
5308	Process not Found
2568	Process not Found
4356	Process not Found
4412	Process not Found
1676	System32.exe
3396	svchost.exe
1852	Process not Found
4352	Process not Found
808	Process not Found
576	Process not Found
3520	Process not Found
2644	Process not Found
6088	Process not Found
4568	Process not Found
5068	Process not Found
3168	Process not Found
2676	Process not Found
1052	Process not Found
5856	Process not Found
4304	Process not Found
916	Process not Found
5616	Process not Found
5816	Process not Found
4296	Process not Found
3440	Process not Found
5848	Process not Found
3852	Process not Found
5928	Process not Found
5596	Process not Found
8	Process not Found
1076	Process not Found
1408	Process not Found
5704	Process not Found
1884	Process not Found
4496	Process not Found
5112	Process not Found
2772	Process not Found
3112	Process not Found
4600	Process not Found
1372	Process not Found
4412	Process not Found
5068	Process not Found
1216	Process not Found
1772	Process not Found
3692	Process not Found
2308	Process not Found
5536	Process not Found
3708	Process not Found
5640	Process not Found
1444	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\System32.exe = "C:\\Users\\Admin\\Videos\\System32.exe"	SSh_Client.exe

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
11	api.ipify.org
14	icanhazip.com
1	api.ipify.org
1	icanhazip.com
6	api.ipify.org

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	SSh_Client.exe

Executes a command shell one-liner 1 TTPs 48 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5844	CMD.exe
5664	CMD.exe
5872	CMD.exe
4832	CMD.exe
908	CMD.exe
4660	CMD.exe
1172	CMD.exe
1656	CMD.exe
1604	CMD.exe
5056	CMD.exe
716	CMD.exe
2392	CMD.exe
4388	CMD.exe
624	CMD.exe
4128	CMD.exe
5324	CMD.exe
3320	CMD.exe
4824	CMD.exe
3408	CMD.exe
2720	CMD.exe
3196	CMD.exe
1440	CMD.exe
2104	CMD.exe
2620	CMD.exe
2568	CMD.exe
200	CMD.exe
2624	CMD.exe
5128	CMD.exe
4776	CMD.exe
1196	CMD.exe
3340	CMD.exe
2604	CMD.exe
5136	CMD.exe
256	CMD.exe
6000	CMD.exe
6108	CMD.exe
912	CMD.exe
948	CMD.exe
4904	CMD.exe
2888	CMD.exe
2164	CMD.exe
688	CMD.exe
6104	CMD.exe
5000	CMD.exe
2148	CMD.exe
1452	CMD.exe
1468	CMD.exe
5388	CMD.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2772	schtasks.exe
2840	schtasks.exe
5892	schtasks.exe
2000	schtasks.exe
1492	schtasks.exe
1588	schtasks.exe
2440	schtasks.exe
4628	schtasks.exe
4840	schtasks.exe
472	schtasks.exe
248	schtasks.exe
5488	schtasks.exe
6044	schtasks.exe
2132	schtasks.exe
3896	schtasks.exe
2964	schtasks.exe
2508	schtasks.exe
5252	schtasks.exe
5980	schtasks.exe
860	schtasks.exe
4272	schtasks.exe
1048	schtasks.exe
2656	schtasks.exe
6068	schtasks.exe
3556	schtasks.exe
3548	schtasks.exe
2468	schtasks.exe
2448	schtasks.exe
5436	schtasks.exe
3144	schtasks.exe
2920	schtasks.exe
1900	schtasks.exe
348	schtasks.exe
5608	schtasks.exe
2296	schtasks.exe
4580	schtasks.exe
892	schtasks.exe
5760	schtasks.exe
2748	schtasks.exe
380	schtasks.exe
1580	schtasks.exe
2804	schtasks.exe
5052	schtasks.exe
4600	schtasks.exe
5808	schtasks.exe
5152	schtasks.exe
4364	schtasks.exe
1736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
1676	System32.exe
1676	System32.exe
3396	svchost.exe
3396	svchost.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe
4612	SSh_Client.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4612	SSh_Client.exe
Token: SeDebugPrivilege	1676	System32.exe
Token: SeDebugPrivilege	3396	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 5844	4612	SSh_Client.exe	90
PID 5844 wrote to memory of 892	5844	CMD.exe	92
PID 4612 wrote to memory of 2392	4612	SSh_Client.exe	93
PID 2392 wrote to memory of 248	2392	CMD.exe	95
PID 4612 wrote to memory of 4660	4612	SSh_Client.exe	96
PID 4660 wrote to memory of 5488	4660	CMD.exe	98
PID 4612 wrote to memory of 6000	4612	SSh_Client.exe	99
PID 6000 wrote to memory of 5760	6000	CMD.exe	101
PID 4612 wrote to memory of 6108	4612	SSh_Client.exe	106
PID 6108 wrote to memory of 2748	6108	CMD.exe	108
PID 4612 wrote to memory of 1172	4612	SSh_Client.exe	109
PID 1172 wrote to memory of 6044	1172	CMD.exe	111
PID 4612 wrote to memory of 912	4612	SSh_Client.exe	113
PID 912 wrote to memory of 5980	912	CMD.exe	115
PID 4612 wrote to memory of 1196	4612	SSh_Client.exe	116
PID 1196 wrote to memory of 860	1196	CMD.exe	118
PID 4612 wrote to memory of 4824	4612	SSh_Client.exe	119
PID 4824 wrote to memory of 2772	4824	CMD.exe	121
PID 1676 wrote to memory of 4388	1676	System32.exe	122
PID 4388 wrote to memory of 2840	4388	CMD.exe	124
PID 4612 wrote to memory of 624	4612	SSh_Client.exe	125
PID 624 wrote to memory of 4600	624	CMD.exe	127
PID 3396 wrote to memory of 948	3396	svchost.exe	128
PID 948 wrote to memory of 2132	948	CMD.exe	130
PID 3396 wrote to memory of 5664	3396	svchost.exe	131
PID 5664 wrote to memory of 5808	5664	CMD.exe	133
PID 4612 wrote to memory of 3340	4612	SSh_Client.exe	134
PID 3340 wrote to memory of 3144	3340	CMD.exe	136
PID 3396 wrote to memory of 3408	3396	svchost.exe	137
PID 3408 wrote to memory of 5892	3408	CMD.exe	139
PID 4612 wrote to memory of 2720	4612	SSh_Client.exe	140
PID 2720 wrote to memory of 2920	2720	CMD.exe	142
PID 4612 wrote to memory of 3196	4612	SSh_Client.exe	143
PID 3196 wrote to memory of 5152	3196	CMD.exe	145
PID 4612 wrote to memory of 1656	4612	SSh_Client.exe	146
PID 1656 wrote to memory of 1900	1656	CMD.exe	148
PID 4612 wrote to memory of 2604	4612	SSh_Client.exe	149
PID 2604 wrote to memory of 2000	2604	CMD.exe	151
PID 4612 wrote to memory of 5136	4612	SSh_Client.exe	152
PID 5136 wrote to memory of 3896	5136	CMD.exe	154
PID 4612 wrote to memory of 6104	4612	SSh_Client.exe	155
PID 6104 wrote to memory of 4272	6104	CMD.exe	157
PID 4612 wrote to memory of 2620	4612	SSh_Client.exe	158
PID 2620 wrote to memory of 348	2620	CMD.exe	160
PID 4612 wrote to memory of 256	4612	SSh_Client.exe	161
PID 256 wrote to memory of 380	256	CMD.exe	163
PID 4612 wrote to memory of 1440	4612	SSh_Client.exe	164
PID 1440 wrote to memory of 1580	1440	CMD.exe	166
PID 4612 wrote to memory of 908	4612	SSh_Client.exe	167
PID 908 wrote to memory of 5608	908	CMD.exe	169
PID 4612 wrote to memory of 5000	4612	SSh_Client.exe	170
PID 5000 wrote to memory of 1048	5000	CMD.exe	172
PID 4612 wrote to memory of 5872	4612	SSh_Client.exe	173
PID 5872 wrote to memory of 2964	5872	CMD.exe	175
PID 4612 wrote to memory of 2568	4612	SSh_Client.exe	176
PID 2568 wrote to memory of 4628	2568	CMD.exe	178
PID 4612 wrote to memory of 2148	4612	SSh_Client.exe	179
PID 2148 wrote to memory of 2656	2148	CMD.exe	181
PID 4612 wrote to memory of 200	4612	SSh_Client.exe	182
PID 200 wrote to memory of 2508	200	CMD.exe	184
PID 4612 wrote to memory of 4128	4612	SSh_Client.exe	185
PID 4128 wrote to memory of 4364	4128	CMD.exe	187
PID 4612 wrote to memory of 4904	4612	SSh_Client.exe	188
PID 4904 wrote to memory of 4840	4904	CMD.exe	190

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SSh_Client.exe
"C:\Users\Admin\AppData\Local\Temp\SSh_Client.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Google Chrome Update" /tr "C:\Users\Admin\Videos\System32.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Google Chrome Update" /tr "C:\Users\Admin\Videos\System32.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2772
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3144
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2920
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5152
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4272
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:348
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:256
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:380
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1580
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5608
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4628
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2656
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:200
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4840
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2888
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2624
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2804
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1492
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5324
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2164
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5052
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1604
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2448
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2296
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5436
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4580
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:716
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1736
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3548
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:472

C:\Users\Admin\Videos\System32.exe
C:\Users\Admin\Videos\System32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2840

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5808
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "CorelDRAW" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\svchost.exe
Size 552KB
SHA256 b55476f41ed05495b4b16cdfd490de1479ba8602cf7be3c4154b5542e1a6b657
MD5 3412aa719b85ee1f9b4e8fe9111dbf0b
SHA1 2dfcfa61fe349d126994b8ccfed4f55b53b36dab
SHA512 33302439ddd1424e42eac5cea3cde847d38e9cb989c383a8b675266de8ce7fcc3ebe544d9937e7bab9db28181272ce389492bb88e5125970ed1fb683cb030c1a
SSDEEP 6144:Nl53yZFOb9gM06DCdaae6VlWT8b9MBRzj8KuVXdlVrb6VlPBEuy0:NXLffDIPVle8+YVNVH0
TLSH
T1DDC4D61CFE81E806CD1A3EB3CFE910049B7121C2AE2295563159AFFD87653B358E667C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4612-1-0x0000000000350000-0x00000000003DE000-memory.dmp

Download

memory/4612-0-0x00007FFC4403F000-0x00007FFC44040000-memory.dmp

Download

memory/4612-2-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4612-3-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4612-4-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4612-5-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4612-6-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download