sheetrat | 1b7c311b9602662a5a903d01c7606359fbed073be26c566d56536b30b2f9a9da

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 08:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windows211.exe
Size 45KB
Sample261012-kmncsaad73
SHA256 1b7c311b9602662a5a903d01c7606359fbed073be26c566d56536b30b2f9a9da
MD5 21eaab19d398de43e9a3de90db615600
SHA1 d7fe7b132cffb07f6edd5bffdbbdd28120b6ec81
SHA512 8ddec211334846ee1d2acda9ff576dcc381e917d976d0a859cb2d5f659eb65bc24dd7a7859625c5496710c9f0cfe4cbc08c289e370f32d05a827a14c9d2daa8e
SSDEEP 768:rTrLugSWmefv21xEHUqCt+ivduG6cS0v+izN0RvObyCmwGSGG5e+mjLtAqV911w5:rTeJEH6si1uG6cS0v+AKhOblx61+UtAx
TLSH
T18C234940B7C85965EA8F42FE93A28245A335D373664BE30F3CDA5CF226823D65301DDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

bqkun47wwt.localto.net:9567
sli4xzafke.localto.net:1537
9pzodny35b.localto.net:1354

Mutex

Attributes

anti_virtual
false
certificate
ohmf6wv41ind5
exclusion_wd
false
hidden_file
true
install
true
install_watch_dog
true
key
ljxemmxt
path_client
%Cookies%\windows11.exe
path_watch_dog
%Cookies%\windows11.exe
pump
false
rootkit
false
use_install_admin
false
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/3448-0-0x00000000007E0000-0x00000000007F0000-memory.dmp	family_sheetrat_v1
behavioral1/files/0x00060000000168d0-4.dat	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\windows11.exe"	windows211.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	windows211.exe

Executes dropped EXE 7 IoCs

pid	Process
5044	windows11.exe
3696	windows11.exe
3708	windows11.exe
1788	windows11.exe
4032	windows11.exe
3656	windows11.exe
4608	windows11.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2808	cmd.exe
1908	cmd.exe
3004	cmd.exe
2392	cmd.exe
3652	cmd.exe
3108	cmd.exe
816	cmd.exe
4848	cmd.exe
2228	cmd.exe
1224	cmd.exe
4228	cmd.exe
4544	cmd.exe
3408	cmd.exe
4920	cmd.exe
224	cmd.exe
1320	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows211.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows211.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4228	schtasks.exe
4976	schtasks.exe
1784	schtasks.exe
4612	schtasks.exe
4668	schtasks.exe
2184	schtasks.exe
1668	schtasks.exe
4484	schtasks.exe
900	schtasks.exe
832	schtasks.exe
2856	schtasks.exe
1068	schtasks.exe
3256	schtasks.exe
1120	schtasks.exe
2696	schtasks.exe
3200	schtasks.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3448	windows211.exe
Token: SeDebugPrivilege	5044	windows11.exe
Token: SeDebugPrivilege	3696	windows11.exe
Token: SeDebugPrivilege	3708	windows11.exe
Token: SeDebugPrivilege	1788	windows11.exe
Token: SeDebugPrivilege	4032	windows11.exe
Token: SeDebugPrivilege	3656	windows11.exe
Token: SeDebugPrivilege	4608	windows11.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1524	3448	windows211.exe	93
PID 3448 wrote to memory of 4848	3448	windows211.exe	94
PID 4848 wrote to memory of 3256	4848	cmd.exe	97
PID 3448 wrote to memory of 2808	3448	windows211.exe	98
PID 2808 wrote to memory of 4668	2808	cmd.exe	100
PID 3448 wrote to memory of 5044	3448	windows211.exe	102
PID 5044 wrote to memory of 4920	5044	windows11.exe	105
PID 4920 wrote to memory of 2184	4920	cmd.exe	107
PID 5044 wrote to memory of 3408	5044	windows11.exe	108
PID 3408 wrote to memory of 1668	3408	cmd.exe	110
PID 3696 wrote to memory of 224	3696	windows11.exe	118
PID 224 wrote to memory of 4484	224	cmd.exe	120
PID 3696 wrote to memory of 2228	3696	windows11.exe	121
PID 2228 wrote to memory of 4228	2228	cmd.exe	123
PID 3708 wrote to memory of 1224	3708	windows11.exe	124
PID 1224 wrote to memory of 4976	1224	cmd.exe	126
PID 3708 wrote to memory of 1320	3708	windows11.exe	127
PID 1320 wrote to memory of 1120	1320	cmd.exe	129
PID 1788 wrote to memory of 1908	1788	windows11.exe	138
PID 1908 wrote to memory of 900	1908	cmd.exe	140
PID 1788 wrote to memory of 4228	1788	windows11.exe	141
PID 4228 wrote to memory of 832	4228	cmd.exe	143
PID 4032 wrote to memory of 4544	4032	windows11.exe	144
PID 4544 wrote to memory of 2696	4544	cmd.exe	146
PID 4032 wrote to memory of 3004	4032	windows11.exe	147
PID 3004 wrote to memory of 2856	3004	cmd.exe	149
PID 3656 wrote to memory of 3108	3656	windows11.exe	150
PID 3108 wrote to memory of 1784	3108	cmd.exe	152
PID 3656 wrote to memory of 816	3656	windows11.exe	153
PID 816 wrote to memory of 1068	816	cmd.exe	155
PID 4608 wrote to memory of 2392	4608	windows11.exe	156
PID 2392 wrote to memory of 3200	2392	cmd.exe	158
PID 4608 wrote to memory of 3652	4608	windows11.exe	159
PID 3652 wrote to memory of 4612	3652	cmd.exe	161

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\windows211.exe
"C:\Users\Admin\AppData\Local\Temp\windows211.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="RDu.=XOd=ufE=(" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" enable=yes & exit
  2⤵
  PID:1524
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3256
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4668
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2184
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1668

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4484
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4228

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4976
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1120

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:900
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:832

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2696
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2856

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1784
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1068

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3200
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windows11.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\windows11.exe.log
Size 642B
SHA256 f9481e31897c3d9071b744e1638942b52c46858c16ccf692f5c6e109a8b092f6
MD5 e19ed69089e56bbfaaba5e5e63d0354f
SHA1 287519bf7c4ec630e4326db00809f627f927ebef
SHA512 c4a8678d28eea4c3a3adfe0324943478efabef839d3bdacb0e4c278e97ee356037c0bfd83b096952b43d81af0b7253eb7d666416e0024ce93a1c516a834fd05b
TLSH
T18EF078313365E2D889663F16282C268803BF4765E690EE0C7594A2AED9365235F212E7
MD5 SHA1 SHA512 TLSH

Submit Download

windows11.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
Size 45KB
SHA256 1b7c311b9602662a5a903d01c7606359fbed073be26c566d56536b30b2f9a9da
MD5 21eaab19d398de43e9a3de90db615600
SHA1 d7fe7b132cffb07f6edd5bffdbbdd28120b6ec81
SHA512 8ddec211334846ee1d2acda9ff576dcc381e917d976d0a859cb2d5f659eb65bc24dd7a7859625c5496710c9f0cfe4cbc08c289e370f32d05a827a14c9d2daa8e
SSDEEP 768:rTrLugSWmefv21xEHUqCt+ivduG6cS0v+izN0RvObyCmwGSGG5e+mjLtAqV911w5:rTeJEH6si1uG6cS0v+AKhOblx61+UtAx
TLSH
T18C234940B7C85965EA8F42FE93A28245A335D373664BE30F3CDA5CF226823D65301DDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3448-0-0x00000000007E0000-0x00000000007F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads