sheetrat | 78746830d4762a0e77834fcd73efab4eb6d06c7c2f2227b171fac39d9c9ff50e

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/10/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.exe
Size 385KB
Sample261015-tpfkdsh14m
SHA256 78746830d4762a0e77834fcd73efab4eb6d06c7c2f2227b171fac39d9c9ff50e
MD5 82de4dfdaa8cfc8c34607da6e15b49cf
SHA1 704105c62582f344a0213523b4ace63c54c8b626
SHA512 a244305ab398e125c15b1ffd8768dc1fbbfcaccb6d31f85283dcc9e7c7ba21a22e259741487254ef9645b9b6d67254ac8a8757a333844963bc38b1d9093a5c7a
SSDEEP 6144:rDmIIEl6GhH6Ufbe6VlWT8b98axrOqEfeccm7robFNJW3:/mIB/hH6UDPVle8qaNO1cmam3
TLSH
T1B484D50CFE91F806DE2E3DB7CBE614008B7125C12E2192563159AFFD8B6537658E62BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_xhkwqhdrsk discovery execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_xhkwqhdrsk

xcl.cantdown.su:1696

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/5648-0-0x0000000000810000-0x0000000000876000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral2/memory/5648-0-0x0000000000810000-0x0000000000876000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdDiscord.exe"	test.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
6064	xdwdDiscord.exe

Loads dropped DLL 51 IoCs

pid	Process
1768	Process not Found
4448	Process not Found
5452	Process not Found
1228	Process not Found
6064	xdwdDiscord.exe
4052	Process not Found
4804	WmiApSrv.exe
3412	Process not Found
3900	Process not Found
2312	Process not Found
4156	Process not Found
5548	Process not Found
1592	Process not Found
4444	Process not Found
1116	Process not Found
3368	Process not Found
2416	Process not Found
5588	Process not Found
3348	Process not Found
4764	Process not Found
4336	Process not Found
5448	Process not Found
3616	Process not Found
5256	Process not Found
5720	Process not Found
3524	Process not Found
4988	Process not Found
3992	Process not Found
4016	Process not Found
3208	Process not Found
5732	Process not Found
2800	Process not Found
3920	Process not Found
2168	Process not Found
2560	Process not Found
3528	Process not Found
1168	Process not Found
2344	Process not Found
5548	Process not Found
2108	Process not Found
760	Process not Found
6088	Process not Found
3368	Process not Found
3148	Process not Found
884	Process not Found
880	Process not Found
5588	Process not Found
2372	Process not Found
4764	Process not Found
6068	Process not Found
272	Process not Found

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\xdwdDiscord.exe	test.exe
File opened for modification	C:\Windows\xdwdDiscord.exe	test.exe
File created	C:\Windows\xdwd.dll	test.exe
File opened for modification	C:\Windows\xdwdDiscord.exe	xdwdDiscord.exe

Executes a command shell one-liner 1 TTPs 47 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6000	CMD.exe
4000	CMD.exe
4680	CMD.exe
5208	CMD.exe
4424	CMD.exe
2528	CMD.exe
4600	CMD.exe
6040	CMD.exe
2364	CMD.exe
1832	CMD.exe
5624	CMD.exe
4548	CMD.exe
5444	CMD.exe
1316	CMD.exe
3164	CMD.exe
6032	CMD.exe
808	CMD.exe
5944	CMD.exe
6124	CMD.exe
4704	CMD.exe
6076	CMD.exe
4776	CMD.exe
4540	CMD.exe
4560	CMD.exe
2056	CMD.exe
5816	CMD.exe
3752	CMD.exe
4448	CMD.exe
3008	CMD.exe
5804	CMD.exe
1884	CMD.exe
2088	CMD.exe
1280	CMD.exe
4640	CMD.exe
5780	CMD.exe
2884	CMD.exe
6016	CMD.exe
3212	CMD.exe
860	CMD.exe
5152	CMD.exe
5672	CMD.exe
2472	CMD.exe
2292	CMD.exe
4552	CMD.exe
1128	CMD.exe
5100	CMD.exe
5044	CMD.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	test.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	test.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwdDiscord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwdDiscord.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 47 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3932	schtasks.exe
4220	schtasks.exe
4008	schtasks.exe
3628	schtasks.exe
2424	schtasks.exe
3484	schtasks.exe
2116	schtasks.exe
5248	schtasks.exe
6100	schtasks.exe
4080	schtasks.exe
1540	schtasks.exe
5440	schtasks.exe
4888	schtasks.exe
468	schtasks.exe
4044	schtasks.exe
4656	schtasks.exe
3940	schtasks.exe
3116	schtasks.exe
1136	schtasks.exe
2436	schtasks.exe
1672	schtasks.exe
5984	schtasks.exe
2040	schtasks.exe
4880	schtasks.exe
3700	schtasks.exe
2576	schtasks.exe
2432	schtasks.exe
1388	schtasks.exe
1620	schtasks.exe
4152	schtasks.exe
1172	schtasks.exe
4872	schtasks.exe
1888	schtasks.exe
3664	schtasks.exe
5436	schtasks.exe
4948	schtasks.exe
3788	schtasks.exe
4656	schtasks.exe
3152	schtasks.exe
6088	schtasks.exe
5776	schtasks.exe
6084	schtasks.exe
1476	schtasks.exe
5676	schtasks.exe
3196	schtasks.exe
4888	schtasks.exe
4328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
5648	test.exe
4804	WmiApSrv.exe
4804	WmiApSrv.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5648	test.exe
Token: SeDebugPrivilege	6064	xdwdDiscord.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 6000	5648	test.exe	83
PID 6000 wrote to memory of 1888	6000	CMD.exe	85
PID 5648 wrote to memory of 4704	5648	test.exe	86
PID 4704 wrote to memory of 3932	4704	CMD.exe	88
PID 5648 wrote to memory of 860	5648	test.exe	89
PID 860 wrote to memory of 2576	860	CMD.exe	91
PID 5648 wrote to memory of 6076	5648	test.exe	96
PID 6076 wrote to memory of 3664	6076	CMD.exe	98
PID 5648 wrote to memory of 4000	5648	test.exe	101
PID 4000 wrote to memory of 5436	4000	CMD.exe	103
PID 5648 wrote to memory of 1280	5648	test.exe	104
PID 1280 wrote to memory of 468	1280	CMD.exe	106
PID 5648 wrote to memory of 6040	5648	test.exe	107
PID 6040 wrote to memory of 4948	6040	CMD.exe	109
PID 5648 wrote to memory of 2364	5648	test.exe	110
PID 2364 wrote to memory of 4044	2364	CMD.exe	112
PID 6064 wrote to memory of 4640	6064	xdwdDiscord.exe	113
PID 4640 wrote to memory of 3788	4640	CMD.exe	115
PID 5648 wrote to memory of 2056	5648	test.exe	116
PID 2056 wrote to memory of 1136	2056	CMD.exe	118
PID 6064 wrote to memory of 4552	6064	xdwdDiscord.exe	119
PID 4552 wrote to memory of 6088	4552	CMD.exe	121
PID 5648 wrote to memory of 1832	5648	test.exe	122
PID 1832 wrote to memory of 3484	1832	CMD.exe	124
PID 5648 wrote to memory of 5152	5648	test.exe	125
PID 5152 wrote to memory of 4656	5152	CMD.exe	127
PID 5648 wrote to memory of 4680	5648	test.exe	128
PID 4680 wrote to memory of 2116	4680	CMD.exe	130
PID 5648 wrote to memory of 1128	5648	test.exe	131
PID 1128 wrote to memory of 4888	1128	CMD.exe	133
PID 5648 wrote to memory of 4776	5648	test.exe	134
PID 4776 wrote to memory of 2432	4776	CMD.exe	136
PID 5648 wrote to memory of 5208	5648	test.exe	137
PID 5208 wrote to memory of 5776	5208	CMD.exe	139
PID 5648 wrote to memory of 5100	5648	test.exe	140
PID 5100 wrote to memory of 3940	5100	CMD.exe	142
PID 5648 wrote to memory of 5816	5648	test.exe	143
PID 5816 wrote to memory of 1388	5816	CMD.exe	145
PID 5648 wrote to memory of 5672	5648	test.exe	146
PID 5672 wrote to memory of 4220	5672	CMD.exe	148
PID 5648 wrote to memory of 3752	5648	test.exe	149
PID 3752 wrote to memory of 2436	3752	CMD.exe	151
PID 5648 wrote to memory of 5624	5648	test.exe	152
PID 5624 wrote to memory of 1620	5624	CMD.exe	154
PID 5648 wrote to memory of 3164	5648	test.exe	155
PID 3164 wrote to memory of 1672	3164	CMD.exe	157
PID 5648 wrote to memory of 4548	5648	test.exe	158
PID 4548 wrote to memory of 5984	4548	CMD.exe	160
PID 5648 wrote to memory of 5444	5648	test.exe	161
PID 5444 wrote to memory of 2040	5444	CMD.exe	163
PID 5648 wrote to memory of 4448	5648	test.exe	164
PID 4448 wrote to memory of 4880	4448	CMD.exe	166
PID 5648 wrote to memory of 1316	5648	test.exe	167
PID 1316 wrote to memory of 4008	1316	CMD.exe	169
PID 5648 wrote to memory of 4540	5648	test.exe	170
PID 4540 wrote to memory of 3628	4540	CMD.exe	172
PID 5648 wrote to memory of 2472	5648	test.exe	173
PID 2472 wrote to memory of 5248	2472	CMD.exe	175
PID 5648 wrote to memory of 4424	5648	test.exe	176
PID 4424 wrote to memory of 6100	4424	CMD.exe	178
PID 5648 wrote to memory of 2528	5648	test.exe	179
PID 2528 wrote to memory of 6084	2528	CMD.exe	181
PID 5648 wrote to memory of 3008	5648	test.exe	182
PID 3008 wrote to memory of 1476	3008	CMD.exe	184

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Access" /tr "C:\Windows\xdwdDiscord.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Access" /tr "C:\Windows\xdwdDiscord.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Dropbox" /tr "C:\Users\Admin\Videos\xdwdMicrosoft Paint Host.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Dropbox" /tr "C:\Users\Admin\Videos\xdwdMicrosoft Paint Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3664
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5436
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1136
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3484
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4656
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3940
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2436
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1672
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4880
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3628
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6084
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5804
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4328
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4080
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6032
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4152
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1540
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5780
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1172
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5944
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4656
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2292
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5676
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5044
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2424
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4600
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6016
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4560
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3196
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3152

C:\Windows\xdwdDiscord.exe
C:\Windows\xdwdDiscord.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3788
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft SQL Server Management Studio" /tr "C:\Windows\xdwdDiscord.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6088

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5648-0-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/5648-32-0x000000001D170000-0x000000001D180000-memory.dmp

Download

memory/5648-85-0x000000001D170000-0x000000001D180000-memory.dmp

Download

memory/5648-115-0x000000001D580000-0x000000001D6C6000-memory.dmp

Download

memory/5648-114-0x000000001D500000-0x000000001D576000-memory.dmp

Download

memory/5648-116-0x000000001D400000-0x000000001D41E000-memory.dmp

Download