sheetrat | 1b7c311b9602662a5a903d01c7606359fbed073be26c566d56536b30b2f9a9da

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 08:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windows211.exe
Size 45KB
Sample261012-kmncsaad73
SHA256 1b7c311b9602662a5a903d01c7606359fbed073be26c566d56536b30b2f9a9da
MD5 21eaab19d398de43e9a3de90db615600
SHA1 d7fe7b132cffb07f6edd5bffdbbdd28120b6ec81
SHA512 8ddec211334846ee1d2acda9ff576dcc381e917d976d0a859cb2d5f659eb65bc24dd7a7859625c5496710c9f0cfe4cbc08c289e370f32d05a827a14c9d2daa8e
SSDEEP 768:rTrLugSWmefv21xEHUqCt+ivduG6cS0v+izN0RvObyCmwGSGG5e+mjLtAqV911w5:rTeJEH6si1uG6cS0v+AKhOblx61+UtAx
TLSH
T18C234940B7C85965EA8F42FE93A28245A335D373664BE30F3CDA5CF226823D65301DDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

bqkun47wwt.localto.net:9567
sli4xzafke.localto.net:1537
9pzodny35b.localto.net:1354

Mutex

Attributes

anti_virtual
false
certificate
ohmf6wv41ind5
exclusion_wd
false
hidden_file
true
install
true
install_watch_dog
true
key
ljxemmxt
path_client
%Cookies%\windows11.exe
path_watch_dog
%Cookies%\windows11.exe
pump
false
rootkit
false
use_install_admin
false
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/1652-0-0x00000000009A0000-0x00000000009B0000-memory.dmp	family_sheetrat_v1
behavioral2/files/0x0004000000008f26-10.dat	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\windows11.exe"	windows211.exe

Executes dropped EXE 15 IoCs

pid	Process
3252	windows11.exe
6048	windows11.exe
2744	windows11.exe
4616	windows11.exe
200	windows11.exe
2140	windows11.exe
1064	windows11.exe
3356	windows11.exe
4588	windows11.exe
4476	windows11.exe
360	windows11.exe
5148	windows11.exe
4980	windows11.exe
5096	windows11.exe
4284	windows11.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 32 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5012	cmd.exe
2212	cmd.exe
1668	cmd.exe
2872	cmd.exe
2416	cmd.exe
4148	cmd.exe
3004	cmd.exe
1396	cmd.exe
2004	cmd.exe
5936	cmd.exe
5864	cmd.exe
5996	cmd.exe
1772	cmd.exe
5708	cmd.exe
4760	cmd.exe
3028	cmd.exe
5572	cmd.exe
4320	cmd.exe
5904	cmd.exe
2964	cmd.exe
4572	cmd.exe
3844	cmd.exe
5276	cmd.exe
5000	cmd.exe
3268	cmd.exe
3020	cmd.exe
4776	cmd.exe
3308	cmd.exe
1252	cmd.exe
5432	cmd.exe
4684	cmd.exe
1228	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 32 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows211.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows211.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	windows11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	windows11.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 32 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
696	schtasks.exe
4668	schtasks.exe
2964	schtasks.exe
3428	schtasks.exe
1316	schtasks.exe
5352	schtasks.exe
3280	schtasks.exe
1432	schtasks.exe
4740	schtasks.exe
5736	schtasks.exe
4756	schtasks.exe
2360	schtasks.exe
5292	schtasks.exe
6060	schtasks.exe
300	schtasks.exe
5008	schtasks.exe
5148	schtasks.exe
4272	schtasks.exe
1936	schtasks.exe
3352	schtasks.exe
2976	schtasks.exe
1940	schtasks.exe
2800	schtasks.exe
1852	schtasks.exe
5500	schtasks.exe
3488	schtasks.exe
3476	schtasks.exe
4700	schtasks.exe
3392	schtasks.exe
2208	schtasks.exe
1096	schtasks.exe
2332	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	windows211.exe
Token: SeDebugPrivilege	3252	windows11.exe
Token: SeDebugPrivilege	6048	windows11.exe
Token: SeDebugPrivilege	2744	windows11.exe
Token: SeDebugPrivilege	200	windows11.exe
Token: SeDebugPrivilege	4616	windows11.exe
Token: SeDebugPrivilege	2140	windows11.exe
Token: SeDebugPrivilege	1064	windows11.exe
Token: SeDebugPrivilege	3356	windows11.exe
Token: SeDebugPrivilege	4588	windows11.exe
Token: SeDebugPrivilege	4476	windows11.exe
Token: SeDebugPrivilege	360	windows11.exe
Token: SeDebugPrivilege	4980	windows11.exe
Token: SeDebugPrivilege	5096	windows11.exe
Token: SeDebugPrivilege	5148	windows11.exe
Token: SeDebugPrivilege	4284	windows11.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1552	1652	windows211.exe	89
PID 1652 wrote to memory of 5864	1652	windows211.exe	90
PID 5864 wrote to memory of 5148	5864	cmd.exe	93
PID 1652 wrote to memory of 4760	1652	windows211.exe	94
PID 4760 wrote to memory of 4668	4760	cmd.exe	96
PID 1652 wrote to memory of 3252	1652	windows211.exe	97
PID 3252 wrote to memory of 1668	3252	windows11.exe	98
PID 1668 wrote to memory of 5352	1668	cmd.exe	100
PID 3252 wrote to memory of 3308	3252	windows11.exe	101
PID 3308 wrote to memory of 2332	3308	cmd.exe	103
PID 6048 wrote to memory of 5996	6048	windows11.exe	106
PID 5996 wrote to memory of 3280	5996	cmd.exe	108
PID 6048 wrote to memory of 1252	6048	windows11.exe	109
PID 1252 wrote to memory of 2964	1252	cmd.exe	111
PID 2744 wrote to memory of 1772	2744	windows11.exe	112
PID 1772 wrote to memory of 1432	1772	cmd.exe	114
PID 2744 wrote to memory of 5432	2744	windows11.exe	115
PID 5432 wrote to memory of 1936	5432	cmd.exe	117
PID 4616 wrote to memory of 5904	4616	windows11.exe	123
PID 4616 wrote to memory of 3020	4616	windows11.exe	125
PID 200 wrote to memory of 5012	200	windows11.exe	126
PID 3020 wrote to memory of 2208	3020	cmd.exe	129
PID 5012 wrote to memory of 3428	5012	cmd.exe	130
PID 5904 wrote to memory of 5736	5904	cmd.exe	131
PID 200 wrote to memory of 2004	200	windows11.exe	132
PID 2004 wrote to memory of 1316	2004	cmd.exe	135
PID 2140 wrote to memory of 5936	2140	windows11.exe	134
PID 5936 wrote to memory of 4740	5936	cmd.exe	137
PID 2140 wrote to memory of 4776	2140	windows11.exe	138
PID 1064 wrote to memory of 4684	1064	windows11.exe	139
PID 4776 wrote to memory of 4756	4776	cmd.exe	142
PID 4684 wrote to memory of 696	4684	cmd.exe	143
PID 1064 wrote to memory of 3028	1064	windows11.exe	144
PID 3028 wrote to memory of 3352	3028	cmd.exe	146
PID 3356 wrote to memory of 5708	3356	windows11.exe	155
PID 4588 wrote to memory of 2212	4588	windows11.exe	156
PID 4476 wrote to memory of 2872	4476	windows11.exe	157
PID 4588 wrote to memory of 1396	4588	windows11.exe	161
PID 3356 wrote to memory of 3844	3356	windows11.exe	163
PID 4476 wrote to memory of 2964	4476	windows11.exe	165
PID 5708 wrote to memory of 5500	5708	cmd.exe	167
PID 2212 wrote to memory of 2360	2212	cmd.exe	168
PID 2872 wrote to memory of 2976	2872	cmd.exe	169
PID 360 wrote to memory of 5276	360	windows11.exe	170
PID 1396 wrote to memory of 1096	1396	cmd.exe	171
PID 2964 wrote to memory of 5292	2964	cmd.exe	173
PID 360 wrote to memory of 3268	360	windows11.exe	174
PID 3844 wrote to memory of 3488	3844	cmd.exe	175
PID 5276 wrote to memory of 3476	5276	cmd.exe	177
PID 5096 wrote to memory of 2416	5096	windows11.exe	178
PID 3268 wrote to memory of 4700	3268	cmd.exe	180
PID 2416 wrote to memory of 6060	2416	cmd.exe	181
PID 5096 wrote to memory of 5000	5096	windows11.exe	182
PID 5000 wrote to memory of 300	5000	cmd.exe	184
PID 4284 wrote to memory of 4148	4284	windows11.exe	185
PID 4980 wrote to memory of 5572	4980	windows11.exe	187
PID 5148 wrote to memory of 1228	5148	windows11.exe	188
PID 4284 wrote to memory of 3004	4284	windows11.exe	190
PID 4980 wrote to memory of 4320	4980	windows11.exe	193
PID 5148 wrote to memory of 4572	5148	windows11.exe	194
PID 4148 wrote to memory of 3392	4148	cmd.exe	197
PID 5572 wrote to memory of 1940	5572	cmd.exe	198
PID 3004 wrote to memory of 5008	3004	cmd.exe	199
PID 4320 wrote to memory of 2800	4320	cmd.exe	200

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\windows211.exe
"C:\Users\Admin\AppData\Local\Temp\windows211.exe"
1⤵
- Modifies WinLogon for persistence
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="RDu.=XOd=ufE=(" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" enable=yes & exit
  2⤵
  PID:1552
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5148
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4668
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5352
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2332

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3280
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2964

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1432
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1936

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5736
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2208

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:200
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3428
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1316

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4740
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4756

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:696
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3352

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5500
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3488

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2360
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1096

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2976
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5292

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:360
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3476
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4700

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1228
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1852
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4572
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4272

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1940
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2800

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6060
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:300

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3392
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windows11.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\windows11.exe
Size 45KB
SHA256 1b7c311b9602662a5a903d01c7606359fbed073be26c566d56536b30b2f9a9da
MD5 21eaab19d398de43e9a3de90db615600
SHA1 d7fe7b132cffb07f6edd5bffdbbdd28120b6ec81
SHA512 8ddec211334846ee1d2acda9ff576dcc381e917d976d0a859cb2d5f659eb65bc24dd7a7859625c5496710c9f0cfe4cbc08c289e370f32d05a827a14c9d2daa8e
SSDEEP 768:rTrLugSWmefv21xEHUqCt+ivduG6cS0v+izN0RvObyCmwGSGG5e+mjLtAqV911w5:rTeJEH6si1uG6cS0v+AKhOblx61+UtAx
TLSH
T18C234940B7C85965EA8F42FE93A28245A335D373664BE30F3CDA5CF226823D65301DDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1652-1-0x00007FF9AD9CF000-0x00007FF9AD9D0000-memory.dmp

Download

memory/1652-0-0x00000000009A0000-0x00000000009B0000-memory.dmp

Download

memory/1652-2-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp

Download

memory/1652-3-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp

Download

memory/1652-4-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp

Download

memory/1652-5-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp

Download

memory/1652-6-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp

Download

memory/1652-85-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads