sheetrat | 1ee5b4d41a9e94c630e7fd2da1b0d76ea01f4b16969e843499cbe061853ada45

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 592KB
Sample261017-rdeslsfc77
SHA256 1ee5b4d41a9e94c630e7fd2da1b0d76ea01f4b16969e843499cbe061853ada45
MD5 7230683920983d7f0efb9aac89c31cff
SHA1 0ecb30d050abd35d3d94b3f349f73026e1a0636e
SHA512 2d1d59dabe40a9d60a79afe8f40c1c380e4d773bac5b3d9e7ec6a0e0ed3ad4e838900734f49b9cd71a4a4eb71d1148da71f0e89a952d7b561948542f432162e2
SSDEEP 6144:oKg0lbA+WK4r8MMfNm2gz2tbLfFgZe6VlWT8b9WV3BxRkuLecApgUKp8XM14+jVH:FDRAxK4mVm25WPVle82fKjgjuXULR
TLSH
T104D4C40CFE91E805CE1E3DB7CFEA15004B7161C1AE1296462119AFFE8B653735AE267C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_epiaqpqrzvgrfndtz discovery execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_epiaqpqrzvgrfndtz

gromkuki1242-60447.portmap.host:60447

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/2596-0-0x0000000000830000-0x00000000008CA000-memory.dmp	family_sheetrat_v4
behavioral1/files/0x00070000000244b1-4.dat	family_sheetrat_v4

Detects Sheetrat obfuscated version 2 IoCs

resource	yara_rule
behavioral1/memory/2596-0-0x0000000000830000-0x00000000008CA000-memory.dmp	Sheetrat_v5
behavioral1/files/0x00070000000244b1-4.dat	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Sub\\Client.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	WatchDog.exe

Executes dropped EXE 2 IoCs

pid	Process
4684	WatchDog.exe
2636	Client.exe

Loads dropped DLL 51 IoCs

pid	Process
4768	Process not Found
692	Process not Found
4804	Process not Found
3928	Process not Found
4684	WatchDog.exe
2760	Process not Found
3880	WmiApSrv.exe
1380	Process not Found
1008	Process not Found
1200	Process not Found
2196	Process not Found
2892	Process not Found
1036	Process not Found
4176	Process not Found
3340	Process not Found
2636	Client.exe
3488	Process not Found
4136	Process not Found
3464	Process not Found
4328	Process not Found
1172	Process not Found
1572	Process not Found
1260	Process not Found
3408	Process not Found
3616	Process not Found
4672	Process not Found
3448	Process not Found
3396	Process not Found
2188	Process not Found
2556	Process not Found
1616	Process not Found
372	Process not Found
3116	Process not Found
3124	Process not Found
2728	Process not Found
4636	Process not Found
1376	Process not Found
1960	Process not Found
2652	Process not Found
1256	Process not Found
820	Process not Found
4192	Process not Found
2952	Process not Found
412	Process not Found
2860	Process not Found
3628	Process not Found
4824	Process not Found
3156	Process not Found
3716	Process not Found
620	Process not Found
1140	Process not Found

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 45 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2372	CMD.exe
824	CMD.exe
2276	CMD.exe
1068	CMD.exe
3524	CMD.exe
3768	CMD.exe
4264	CMD.exe
3408	CMD.exe
1952	CMD.exe
4280	CMD.exe
1048	CMD.exe
3232	CMD.exe
4984	CMD.exe
2228	CMD.exe
4928	CMD.exe
2520	CMD.exe
3288	CMD.exe
4072	CMD.exe
1388	CMD.exe
2572	CMD.exe
696	CMD.exe
4640	CMD.exe
4088	CMD.exe
2248	CMD.exe
1676	CMD.exe
3504	CMD.exe
4496	CMD.exe
2140	CMD.exe
1784	CMD.exe
4672	CMD.exe
3680	CMD.exe
5044	CMD.exe
2900	CMD.exe
2616	CMD.exe
4652	CMD.exe
2236	CMD.exe
4732	CMD.exe
5004	CMD.exe
1836	CMD.exe
4704	CMD.exe
2760	CMD.exe
2880	CMD.exe
3316	CMD.exe
2928	CMD.exe
2960	CMD.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WatchDog.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WatchDog.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2812	schtasks.exe
1432	schtasks.exe
4340	schtasks.exe
1488	schtasks.exe
4220	schtasks.exe
760	schtasks.exe
2248	schtasks.exe
660	schtasks.exe
4916	schtasks.exe
1256	schtasks.exe
2908	schtasks.exe
4732	schtasks.exe
1424	schtasks.exe
3548	schtasks.exe
4956	schtasks.exe
2780	schtasks.exe
884	schtasks.exe
3396	schtasks.exe
3880	schtasks.exe
400	schtasks.exe
4120	schtasks.exe
4728	schtasks.exe
620	schtasks.exe
1868	schtasks.exe
1884	schtasks.exe
3176	schtasks.exe
212	schtasks.exe
3572	schtasks.exe
4304	schtasks.exe
1572	schtasks.exe
2332	schtasks.exe
2276	schtasks.exe
4256	schtasks.exe
3176	schtasks.exe
4260	schtasks.exe
4976	schtasks.exe
3488	schtasks.exe
2604	schtasks.exe
4256	schtasks.exe
2324	schtasks.exe
4696	schtasks.exe
3144	schtasks.exe
2644	schtasks.exe
1484	schtasks.exe
1784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
4684	WatchDog.exe
4684	WatchDog.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
2596	Client.exe
3880	WmiApSrv.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	Client.exe
Token: SeDebugPrivilege	4684	WatchDog.exe
Token: SeDebugPrivilege	2636	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 4280	2596	Client.exe	96
PID 4280 wrote to memory of 1784	4280	CMD.exe	98
PID 2596 wrote to memory of 4072	2596	Client.exe	99
PID 4072 wrote to memory of 2332	4072	CMD.exe	101
PID 2596 wrote to memory of 1048	2596	Client.exe	102
PID 1048 wrote to memory of 4732	1048	CMD.exe	104
PID 2596 wrote to memory of 1676	2596	Client.exe	108
PID 1676 wrote to memory of 2248	1676	CMD.exe	110
PID 2596 wrote to memory of 3524	2596	Client.exe	113
PID 3524 wrote to memory of 2604	3524	CMD.exe	115
PID 2596 wrote to memory of 3232	2596	Client.exe	116
PID 3232 wrote to memory of 4956	3232	CMD.exe	118
PID 2596 wrote to memory of 3504	2596	Client.exe	120
PID 3504 wrote to memory of 3176	3504	CMD.exe	122
PID 2596 wrote to memory of 4984	2596	Client.exe	124
PID 4984 wrote to memory of 2276	4984	CMD.exe	126
PID 4684 wrote to memory of 2960	4684	WatchDog.exe	127
PID 2960 wrote to memory of 4256	2960	CMD.exe	129
PID 2596 wrote to memory of 1388	2596	Client.exe	130
PID 1388 wrote to memory of 2324	1388	CMD.exe	132
PID 4684 wrote to memory of 2636	4684	WatchDog.exe	133
PID 2596 wrote to memory of 2572	2596	Client.exe	134
PID 2572 wrote to memory of 2780	2572	CMD.exe	136
PID 2596 wrote to memory of 5044	2596	Client.exe	137
PID 5044 wrote to memory of 2812	5044	CMD.exe	139
PID 2596 wrote to memory of 2372	2596	Client.exe	140
PID 2372 wrote to memory of 1432	2372	CMD.exe	142
PID 2596 wrote to memory of 2900	2596	Client.exe	143
PID 2900 wrote to memory of 884	2900	CMD.exe	145
PID 2636 wrote to memory of 2228	2636	Client.exe	146
PID 2228 wrote to memory of 3880	2228	CMD.exe	148
PID 2636 wrote to memory of 4928	2636	Client.exe	149
PID 4928 wrote to memory of 660	4928	CMD.exe	151
PID 2596 wrote to memory of 3768	2596	Client.exe	152
PID 3768 wrote to memory of 212	3768	CMD.exe	154
PID 2636 wrote to memory of 4704	2636	Client.exe	155
PID 4704 wrote to memory of 4916	4704	CMD.exe	157
PID 2596 wrote to memory of 824	2596	Client.exe	158
PID 824 wrote to memory of 1256	824	CMD.exe	160
PID 2596 wrote to memory of 4496	2596	Client.exe	161
PID 4496 wrote to memory of 4256	4496	CMD.exe	163
PID 2596 wrote to memory of 2616	2596	Client.exe	164
PID 2616 wrote to memory of 3572	2616	CMD.exe	166
PID 2596 wrote to memory of 696	2596	Client.exe	167
PID 696 wrote to memory of 2908	696	CMD.exe	169
PID 2596 wrote to memory of 2520	2596	Client.exe	170
PID 2520 wrote to memory of 760	2520	CMD.exe	172
PID 2596 wrote to memory of 3288	2596	Client.exe	173
PID 3288 wrote to memory of 1884	3288	CMD.exe	175
PID 2596 wrote to memory of 4640	2596	Client.exe	176
PID 4640 wrote to memory of 4696	4640	CMD.exe	178
PID 2596 wrote to memory of 4264	2596	Client.exe	179
PID 4264 wrote to memory of 400	4264	CMD.exe	181
PID 2596 wrote to memory of 2760	2596	Client.exe	182
PID 2760 wrote to memory of 4120	2760	CMD.exe	184
PID 2596 wrote to memory of 4088	2596	Client.exe	185
PID 4088 wrote to memory of 4728	4088	CMD.exe	187
PID 2596 wrote to memory of 2880	2596	Client.exe	188
PID 2880 wrote to memory of 4340	2880	CMD.exe	190
PID 2596 wrote to memory of 2140	2596	Client.exe	191
PID 2140 wrote to memory of 620	2140	CMD.exe	193
PID 2596 wrote to memory of 3316	2596	Client.exe	194
PID 3316 wrote to memory of 3176	3316	CMD.exe	196
PID 2596 wrote to memory of 5004	2596	Client.exe	197

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1784
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "HelpPane" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\WatchDog.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "HelpPane" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\WatchDog.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4732
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2604
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4956
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3176
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2780
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:884
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:212
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3572
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1884
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:400
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4120
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4728
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4340
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3176
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5004
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4304
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4260
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1424
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4672
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3548
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3396
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3144
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2928
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2644
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1952
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1484
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1572

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\WatchDog.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\WatchDog.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4256
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3880
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:660
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4916

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Sub\Client.exe
Size 592KB
SHA256 1ee5b4d41a9e94c630e7fd2da1b0d76ea01f4b16969e843499cbe061853ada45
MD5 7230683920983d7f0efb9aac89c31cff
SHA1 0ecb30d050abd35d3d94b3f349f73026e1a0636e
SHA512 2d1d59dabe40a9d60a79afe8f40c1c380e4d773bac5b3d9e7ec6a0e0ed3ad4e838900734f49b9cd71a4a4eb71d1148da71f0e89a952d7b561948542f432162e2
SSDEEP 6144:oKg0lbA+WK4r8MMfNm2gz2tbLfFgZe6VlWT8b9WV3BxRkuLecApgUKp8XM14+jVH:FDRAxK4mVm25WPVle82fKjgjuXULR
TLSH
T104D4C40CFE91E805CE1E3DB7CFEA15004B7161C1AE1296462119AFFE8B653735AE267C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2596-0-0x0000000000830000-0x00000000008CA000-memory.dmp

Download

memory/2596-30-0x000000001BC80000-0x000000001BC90000-memory.dmp

Download

memory/2596-101-0x000000001C740000-0x000000001C7B6000-memory.dmp

Download

memory/2596-102-0x00000000015E0000-0x00000000015EC000-memory.dmp

Download

memory/2596-103-0x000000001BBE0000-0x000000001BBFE000-memory.dmp

Download

memory/2596-104-0x000000001BC80000-0x000000001BC90000-memory.dmp

Download

memory/2596-153-0x000000001D830000-0x000000001D976000-memory.dmp

Download

memory/2596-158-0x00000000015F0000-0x0000000001602000-memory.dmp

Download

memory/2596-175-0x000000001BC00000-0x000000001BC82000-memory.dmp

Download