sheetrat | 718cc3106a773c5a6abb9768575a308ee5aa9243c04eae4c35ea465b1bcc5a14

Analysis

user interaction
yes
max time kernel
206s
max time network
208s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/11/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
TEST.exe
Size 423KB
Sample261104-tmlnmady7l
SHA256 718cc3106a773c5a6abb9768575a308ee5aa9243c04eae4c35ea465b1bcc5a14
MD5 6fb118ae582876def785e9e4163eea2b
SHA1 a2726acb9b603a9ae07c5bb3205aa2c445ac285f
SHA512 cd8ba3719ee93249f308791a47abda7e64a053289d56a0586bb0df0f73c0206d4d57c1ce9b3e1777fe62b437c96e7dbc010b32ba717499e1ca5bbf5ab894834b
SSDEEP 6144:E5YYEaInnshGmIr88Q6YDRz1XAeoBbqowPhqNo3odunuQiaabwqa8Ob7SctJs1PC:KEaosUBuZXAeoB+ok3VJAA7h
TLSH
T14B947B25BFE44506E3D90D7F659A6211C76EB2FA19027343B781E8330E46ACDEDAD0D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

xcl.cantdown.su:1696

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwd_Microsoft67"	TEST.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 5 IoCs

pid	Process
2652	xdwd_Microsoft67
3560	xdwd_Microsoft67
1312	xdwd_Microsoft67
236	xdwd_Microsoft67
972	xdwd_Microsoft67

Loads dropped DLL 5 IoCs

pid	Process
2652	xdwd_Microsoft67
3560	xdwd_Microsoft67
1312	xdwd_Microsoft67
236	xdwd_Microsoft67
1816	shutdown.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org
6	api.ipify.org

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\xdwd_Microsoft67	TEST.exe
File opened for modification	C:\Windows\xdwd_Microsoft67	TEST.exe
File created	C:\Windows\xdwd_DiscordUpdate	TEST.exe
File opened for modification	C:\Windows\xdwd_DiscordUpdate	TEST.exe
File created	C:\Windows\xdwd.dll	TEST.exe
File opened for modification	C:\Windows\xdwd.dll	TEST.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1500	cmd.exe
2184	cmd.exe
2920	cmd.exe
5096	cmd.exe
3496	cmd.exe
1728	cmd.exe
2000	cmd.exe
3364	cmd.exe
3996	cmd.exe
4216	cmd.exe
1496	cmd.exe
3412	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwd_Microsoft67
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwd_Microsoft67
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	TEST.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwd_Microsoft67
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwd_Microsoft67
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwd_Microsoft67
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwd_Microsoft67
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwd_Microsoft67
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	TEST.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwd_Microsoft67

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xdwd_Microsoft67
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xdwd_Microsoft67
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xdwd_Microsoft67
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xdwd_Microsoft67
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TEST.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xdwd_Microsoft67
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "222"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3596	schtasks.exe
3812	schtasks.exe
2224	schtasks.exe
2364	schtasks.exe
1660	schtasks.exe
2576	schtasks.exe
800	schtasks.exe
4932	schtasks.exe
3956	schtasks.exe
1280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1876	TEST.exe
1876	TEST.exe
1876	TEST.exe
1876	TEST.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	TEST.exe
Token: SeDebugPrivilege	2652	xdwd_Microsoft67
Token: SeDebugPrivilege	3560	xdwd_Microsoft67
Token: SeIncBasePriorityPrivilege	2652	xdwd_Microsoft67
Token: SeDebugPrivilege	1312	xdwd_Microsoft67
Token: SeDebugPrivilege	236	xdwd_Microsoft67
Token: SeShutdownPrivilege	1816	shutdown.exe
Token: SeRemoteShutdownPrivilege	1816	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4236	MiniSearchHost.exe
3956	LogonUI.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 3372	1876	TEST.exe	82
PID 1876 wrote to memory of 3412	1876	TEST.exe	83
PID 3412 wrote to memory of 3596	3412	cmd.exe	86
PID 1876 wrote to memory of 1500	1876	TEST.exe	87
PID 1500 wrote to memory of 3812	1500	cmd.exe	89
PID 1876 wrote to memory of 1728	1876	TEST.exe	90
PID 1728 wrote to memory of 800	1728	cmd.exe	92
PID 1876 wrote to memory of 2000	1876	TEST.exe	93
PID 2000 wrote to memory of 2224	2000	cmd.exe	95
PID 2652 wrote to memory of 3364	2652	xdwd_Microsoft67	98
PID 3364 wrote to memory of 4932	3364	cmd.exe	100
PID 2652 wrote to memory of 3996	2652	xdwd_Microsoft67	102
PID 3996 wrote to memory of 3956	3996	cmd.exe	104
PID 2652 wrote to memory of 4216	2652	xdwd_Microsoft67	106
PID 2652 wrote to memory of 2920	2652	xdwd_Microsoft67	109
PID 2920 wrote to memory of 2364	2920	cmd.exe	111
PID 2652 wrote to memory of 5096	2652	xdwd_Microsoft67	114
PID 5096 wrote to memory of 1660	5096	cmd.exe	116
PID 2652 wrote to memory of 3496	2652	xdwd_Microsoft67	117
PID 3496 wrote to memory of 2576	3496	cmd.exe	119
PID 2652 wrote to memory of 1496	2652	xdwd_Microsoft67	120
PID 1496 wrote to memory of 1816	1496	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\TEST.exe
"C:\Users\Admin\AppData\Local\Temp\TEST.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="~WD!MLc*MDj=M[" dir=in action=allow program="C:\Windows\xdwd_Microsoft67" enable=yes & exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3596
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3812
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:800
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" /RL HIGHEST
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2224

C:\Windows\xdwd_Microsoft67
C:\Windows\xdwd_Microsoft67
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4932
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" /RL HIGHEST
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3956
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" /RL HIGHEST
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" /RL HIGHEST
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2364
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" /RL HIGHEST
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1660
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" /RL HIGHEST
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Shutdown /s /f /t 00
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\SysWOW64\shutdown.exe
    Shutdown /s /f /t 00
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1816

C:\Windows\xdwd_Microsoft67
C:\Windows\xdwd_Microsoft67
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3560
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwd_DiscordUpdate" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2184

C:\Windows\xdwd_Microsoft67
C:\Windows\xdwd_Microsoft67
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1312

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4236

C:\Windows\xdwd_Microsoft67
C:\Windows\xdwd_Microsoft67
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:236

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a38055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3956

C:\Windows\xdwd_Microsoft67
C:\Windows\xdwd_Microsoft67
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd_Microsoft67.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xdwd_Microsoft67.log
Size 517B
SHA256 af516d4cfe09f114527af238011dc193d5c028eed80a979c2f154eb24a258212
MD5 2ce0205879c9b32469888f7b520796c2
SHA1 c86137e1fb5992aa44225f62e64aa8305b7bd508
SHA512 2fd2d6925fb78efa3d7776b1e25cf7094ed260db72b56cf23d3e876146fce8500ec97896917afffb4b09b825dc01bdb404e7c023a77182648aa095b0c6aabbfc
TLSH
T142F09E303331B0D848122F42181C668942FF0745B6B8DF2C3590221EDC350176F322E3
MD5 SHA1 SHA512 TLSH

Submit Download

~earchHoverUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
Size 20KB
SHA256 2a571b61b7f9198267cf8418534b6a546313a38a090cf18dec965fbabd3b2cea
MD5 4cd75ddd0b5acdd78ddca1e1e35d018c
SHA1 c6dd01a621723579aa76a4bc31f2751d37bebfdb
SHA512 88caba78d969b6dce8c3491baa852c03c60ede19a2298dbccb80aa36561aab2e179823d42c757bca4f3fab99aab3b8e97862bf0e8df48dfb834e7ba2baf77daa
SSDEEP 384:fJWJcVca12krtuVm+hglBOVjeQ8RJopfPgh4VjUS2WD5PFm5N+GDa50fRsca3a:B+cVcWrKl8RJyXgSVjUS2yKN+GDa50fh
TLSH
T10592387436F4135AF3B29F759EF1A95A643AB866AC00DB4D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~earchHoverUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
Size 20KB
SHA256 f87fad4ab22b457ae789a2204157b747a3aef4571d6d38396a3bf569e817fd0d
MD5 480c3bd1a2df71081cf31ee0218248a8
SHA1 a87e6f99b796fdd931930ea7832ff850e50134e6
SHA512 51b16e19e3f184f57668c525fe1491bf7632e3c42a2a71a3f30cdf854bcc974927bcea1ddf2d0cd232f101b01885a62062dd3e810412ac16fbc1d70d6e6e91b1
SSDEEP 384:0JWJcVca12krtuVm+hglBOVjeQ8RJoTfPgh4VjUS2WD5PFm5N+GDa50fRsca3a:A+cVcWrKl8RJ0XgSVjUS2yKN+GDa50fh
TLSH
T1A39239743AF41356F3B29F759EF1A95A643AB866AC00DB4D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd_Microsoft67

Path C:\Windows\xdwd_Microsoft67
Size 423KB
SHA256 718cc3106a773c5a6abb9768575a308ee5aa9243c04eae4c35ea465b1bcc5a14
MD5 6fb118ae582876def785e9e4163eea2b
SHA1 a2726acb9b603a9ae07c5bb3205aa2c445ac285f
SHA512 cd8ba3719ee93249f308791a47abda7e64a053289d56a0586bb0df0f73c0206d4d57c1ce9b3e1777fe62b437c96e7dbc010b32ba717499e1ca5bbf5ab894834b
SSDEEP 6144:E5YYEaInnshGmIr88Q6YDRz1XAeoBbqowPhqNo3odunuQiaabwqa8Ob7SctJs1PC:KEaosUBuZXAeoB+ok3VJAA7h
TLSH
T14B947B25BFE44506E3D90D7F659A6211C76EB2FA19027343B781E8330E46ACDEDAD0D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1876-18-0x0000000005760000-0x0000000005770000-memory.dmp

Download

memory/1876-19-0x0000000005760000-0x0000000005770000-memory.dmp

Download

memory/1876-1-0x00000000050A0000-0x0000000005106000-memory.dmp

Download

memory/1876-0-0x00000000004B0000-0x000000000051C000-memory.dmp

Download

memory/2652-73-0x0000000006320000-0x00000000063B2000-memory.dmp

Download

memory/2652-74-0x0000000007460000-0x0000000007A06000-memory.dmp

Download

memory/2652-95-0x0000000007370000-0x000000000743A000-memory.dmp

Download

memory/2652-96-0x00000000063F0000-0x00000000063FA000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads