sheetrat | 433ff820fc808adccb7cc86f9d3eaad9b935bf4486bfe3473a7c1a0eb1ae4428

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bomjt.exe
Size 565KB
Sample260905-tf5sxseq2z
SHA256 433ff820fc808adccb7cc86f9d3eaad9b935bf4486bfe3473a7c1a0eb1ae4428
MD5 b40d5fd0a4be67ba6415d48db1e78f2e
SHA1 ed6b2da7d113679eec354f3e1392e2bb227f1fca
SHA512 3400774a50ebc7887de3f2b415a2ddbcee9064255ade2139d6af31563854ffdb82e4797553eb7ffc539c1f5525d1c4bbe7c8c9e99486d7787e11357936e404ad
SSDEEP 6144:0uwPwSGIm0tPq6a64uMvhy2NRMUdfMZcZo35kXKimVuqmuAxd1cLPYeub0jpeb9q:0z3SbhyPeECa8puI12Uebv
TLSH
T18EC4810CFD81F806DD1A3EB7CFE918109B7121C1AE2195463159AFFD8B6A37258A727C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_kzmcescgwtjsuthvr credential_access discovery execution sheetrat persistence spyware stealer trojan

Malware Config

Extracted

Family

sheetrat

Campaign

Sheet_kzmcescgwtjsuthvr

43.228.157.121:8848

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/4908-1-0x0000000000FE0000-0x0000000001074000-memory.dmp	family_sheetrat_v4
behavioral2/files/0x000e00000001c570-10.dat	family_sheetrat_v4

Detects Sheetrat obfuscated version 2 IoCs

resource	yara_rule
behavioral2/memory/4908-1-0x0000000000FE0000-0x0000000001074000-memory.dmp	Sheetrat_v5
behavioral2/files/0x000e00000001c570-10.dat	Sheetrat_v5

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 2 IoCs

pid	Process
5952	xdwdSpotify.exe
4364	xdwdCCleaner.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\dadadadada = "C:\\Users\\Public\\Documents\\xdwdSpotify.exe"	bomjt.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	icanhazip.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 45 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4900	CMD.exe
6088	CMD.exe
5660	CMD.exe
5912	CMD.exe
2564	CMD.exe
4636	CMD.exe
4336	CMD.exe
2280	CMD.exe
4072	CMD.exe
4784	CMD.exe
120	CMD.exe
1668	CMD.exe
1280	CMD.exe
3892	CMD.exe
4424	CMD.exe
5208	CMD.exe
1120	CMD.exe
1216	CMD.exe
6028	CMD.exe
3240	CMD.exe
3896	CMD.exe
5600	CMD.exe
5972	CMD.exe
4140	CMD.exe
4652	CMD.exe
5888	CMD.exe
4540	CMD.exe
1276	CMD.exe
5636	CMD.exe
4136	CMD.exe
3488	CMD.exe
5312	CMD.exe
3296	CMD.exe
2000	CMD.exe
4484	CMD.exe
6120	CMD.exe
4296	CMD.exe
1864	CMD.exe
4148	CMD.exe
3180	CMD.exe
1236	CMD.exe
356	CMD.exe
788	CMD.exe
3932	CMD.exe
2324	CMD.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5624	schtasks.exe
5328	schtasks.exe
5672	schtasks.exe
4428	schtasks.exe
5352	schtasks.exe
3572	schtasks.exe
5956	schtasks.exe
5964	schtasks.exe
5664	schtasks.exe
5584	schtasks.exe
4744	schtasks.exe
4116	schtasks.exe
4752	schtasks.exe
4568	schtasks.exe
4080	schtasks.exe
5080	schtasks.exe
5656	schtasks.exe
4844	schtasks.exe
2984	schtasks.exe
5904	schtasks.exe
4556	schtasks.exe
5400	schtasks.exe
4800	schtasks.exe
4160	schtasks.exe
3008	schtasks.exe
4532	schtasks.exe
4324	schtasks.exe
1788	schtasks.exe
4948	schtasks.exe
5320	schtasks.exe
1088	schtasks.exe
5744	schtasks.exe
3360	schtasks.exe
2708	schtasks.exe
2200	schtasks.exe
124	schtasks.exe
4676	schtasks.exe
3068	schtasks.exe
4804	schtasks.exe
3576	schtasks.exe
2184	schtasks.exe
5864	schtasks.exe
3700	schtasks.exe
4528	schtasks.exe
2856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe
4908	bomjt.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	bomjt.exe
Token: SeDebugPrivilege	5952	xdwdSpotify.exe
Token: SeDebugPrivilege	4364	xdwdCCleaner.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4336	4908	bomjt.exe	92
PID 4336 wrote to memory of 124	4336	CMD.exe	94
PID 4908 wrote to memory of 4148	4908	bomjt.exe	95
PID 4148 wrote to memory of 3360	4148	CMD.exe	97
PID 4908 wrote to memory of 1120	4908	bomjt.exe	98
PID 1120 wrote to memory of 5656	1120	CMD.exe	100
PID 4908 wrote to memory of 4140	4908	bomjt.exe	103
PID 4140 wrote to memory of 5672	4140	CMD.exe	105
PID 4908 wrote to memory of 1216	4908	bomjt.exe	108
PID 1216 wrote to memory of 4428	1216	CMD.exe	110
PID 4908 wrote to memory of 2280	4908	bomjt.exe	111
PID 2280 wrote to memory of 5352	2280	CMD.exe	113
PID 4908 wrote to memory of 4652	4908	bomjt.exe	115
PID 4652 wrote to memory of 4324	4652	CMD.exe	117
PID 4908 wrote to memory of 4784	4908	bomjt.exe	118
PID 4784 wrote to memory of 5664	4784	CMD.exe	120
PID 5952 wrote to memory of 5888	5952	xdwdSpotify.exe	121
PID 5888 wrote to memory of 1788	5888	CMD.exe	123
PID 4908 wrote to memory of 4900	4908	bomjt.exe	124
PID 4900 wrote to memory of 5584	4900	CMD.exe	126
PID 5952 wrote to memory of 4364	5952	xdwdSpotify.exe	127
PID 4908 wrote to memory of 3180	4908	bomjt.exe	128
PID 3180 wrote to memory of 4744	3180	CMD.exe	130
PID 4908 wrote to memory of 1236	4908	bomjt.exe	131
PID 1236 wrote to memory of 4844	1236	CMD.exe	133
PID 4908 wrote to memory of 5312	4908	bomjt.exe	134
PID 5312 wrote to memory of 5328	5312	CMD.exe	136
PID 4908 wrote to memory of 356	4908	bomjt.exe	137
PID 356 wrote to memory of 4116	356	CMD.exe	139
PID 4364 wrote to memory of 3296	4364	xdwdCCleaner.exe	140
PID 3296 wrote to memory of 3576	3296	CMD.exe	142
PID 4364 wrote to memory of 120	4364	xdwdCCleaner.exe	143
PID 120 wrote to memory of 4752	120	CMD.exe	145
PID 4908 wrote to memory of 788	4908	bomjt.exe	146
PID 788 wrote to memory of 5400	788	CMD.exe	148
PID 4364 wrote to memory of 3892	4364	xdwdCCleaner.exe	149
PID 3892 wrote to memory of 4676	3892	CMD.exe	151
PID 4908 wrote to memory of 6028	4908	bomjt.exe	152
PID 6028 wrote to memory of 3572	6028	CMD.exe	154
PID 4908 wrote to memory of 3932	4908	bomjt.exe	155
PID 3932 wrote to memory of 2184	3932	CMD.exe	157
PID 4908 wrote to memory of 4540	4908	bomjt.exe	158
PID 4540 wrote to memory of 4948	4540	CMD.exe	160
PID 4908 wrote to memory of 4424	4908	bomjt.exe	161
PID 4424 wrote to memory of 2708	4424	CMD.exe	163
PID 4908 wrote to memory of 1668	4908	bomjt.exe	164
PID 1668 wrote to memory of 2984	1668	CMD.exe	166
PID 4908 wrote to memory of 6088	4908	bomjt.exe	167
PID 6088 wrote to memory of 5624	6088	CMD.exe	169
PID 4908 wrote to memory of 3240	4908	bomjt.exe	170
PID 3240 wrote to memory of 4800	3240	CMD.exe	172
PID 4908 wrote to memory of 2324	4908	bomjt.exe	173
PID 2324 wrote to memory of 5864	2324	CMD.exe	175
PID 4908 wrote to memory of 1280	4908	bomjt.exe	176
PID 1280 wrote to memory of 4160	1280	CMD.exe	178
PID 4908 wrote to memory of 2000	4908	bomjt.exe	179
PID 2000 wrote to memory of 2200	2000	CMD.exe	181
PID 4908 wrote to memory of 4484	4908	bomjt.exe	182
PID 4484 wrote to memory of 5956	4484	CMD.exe	184
PID 4908 wrote to memory of 5660	4908	bomjt.exe	185
PID 5660 wrote to memory of 3068	5660	CMD.exe	187
PID 4908 wrote to memory of 6120	4908	bomjt.exe	188
PID 6120 wrote to memory of 4804	6120	CMD.exe	190
PID 4908 wrote to memory of 1276	4908	bomjt.exe	191

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bomjt.exe
"C:\Users\Admin\AppData\Local\Temp\bomjt.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Atom Update" /tr "C:\Users\Public\Documents\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Atom Update" /tr "C:\Users\Public\Documents\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5656
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5672
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4428
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5664
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5584
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4744
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5328
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:356
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5400
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3572
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5864
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2200
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5956
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4804
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5904
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5636
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5208
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4296
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2856
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4636
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5744
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3896
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4532
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4568
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5600
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4080
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5080

C:\Users\Public\Documents\xdwdSpotify.exe
C:\Users\Public\Documents\xdwdSpotify.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1788
- C:\Users\Admin\xdwdCCleaner.exe
  "C:\Users\Admin\xdwdCCleaner.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3576
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:120
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4752
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass" /tr "C:\Users\Admin\xdwdCCleaner.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4676

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwdCCleaner.exe

Path C:\Users\Admin\xdwdCCleaner.exe
Size 565KB
SHA256 433ff820fc808adccb7cc86f9d3eaad9b935bf4486bfe3473a7c1a0eb1ae4428
MD5 b40d5fd0a4be67ba6415d48db1e78f2e
SHA1 ed6b2da7d113679eec354f3e1392e2bb227f1fca
SHA512 3400774a50ebc7887de3f2b415a2ddbcee9064255ade2139d6af31563854ffdb82e4797553eb7ffc539c1f5525d1c4bbe7c8c9e99486d7787e11357936e404ad
SSDEEP 6144:0uwPwSGIm0tPq6a64uMvhy2NRMUdfMZcZo35kXKimVuqmuAxd1cLPYeub0jpeb9q:0z3SbhyPeECa8puI12Uebv
TLSH
T18EC4810CFD81F806DD1A3EB7CFE918109B7121C1AE2195463159AFFD8B6A37258A727C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4908-3-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/4908-2-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/4908-1-0x0000000000FE0000-0x0000000001074000-memory.dmp

Download

memory/4908-4-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/4908-5-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/4908-0-0x00007FFC1C67F000-0x00007FFC1C680000-memory.dmp

Download

memory/4908-20-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/4908-77-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/4908-80-0x000000001C7F0000-0x000000001C866000-memory.dmp

Download

memory/4908-81-0x00000000031B0000-0x00000000031BC000-memory.dmp

Download

memory/4908-82-0x000000001C420000-0x000000001C43E000-memory.dmp

Download

memory/4908-87-0x000000001CAF0000-0x000000001CC36000-memory.dmp

Download