Overview

overview

10

Static

static

1

RatKiller.bat

windows10-2004-x64

10

RatKiller.bat

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    524s
  • max time network
    892s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 08:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RatKiller.bat
  • Size 866KB
  • Sample261110-kxp95av13l
  • SHA256 d17c6931ad3004fe7886d578a7ba5efdc5d5645aa52f251cf3736d432b6610c3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryevasionexecutionsheetratpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Extracted

Family

  • sheetrat

Version

  • 2.6.4

C2

  • openport.pw:35240

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version 2 IoCs
  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • UAC bypass 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell and hide display window.

    execution
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 2 IoCs
    defense_evasion
  • Drops file in Drivers directory 9 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 34 IoCs
    persistence
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 60 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Payload decoded via CertUtil.

    defense_evasion
  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 15 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 18 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 19 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • System policy modification 1 TTPs 22 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RatKiller.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Windows\system32\certutil.exe
      certutil -decode "C:\Users\Admin\AppData\Local\Temp\RatKiller.bat" "RatKiller.exe"
      2⤵
      • Deobfuscate/Decode Files or Information
      PID:4908
    • C:\Users\Admin\AppData\Local\Temp\RatKiller.exe
      "RatKiller.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" & exit
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Windows\system32\schtasks.exe
          SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2040
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ftcetndd.1d2.exe"' & exit
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ftcetndd.1d2.exe"'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2696
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ftcetndd.1d2.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ftcetndd.1d2.exe"
            5⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:6008
            • C:\Windows\system32\drivers\etc\svchost32.exe
              "C:\Windows\system32\drivers\etc\svchost32.exe"
              6⤵
              • Modifies WinLogon for persistence
              • Modifies Windows Defender DisableAntiSpyware settings
              • Modifies Windows Defender Real-time Protection settings
              • UAC bypass
              • Disables RegEdit via registry modification
              • Disables cmd.exe use via registry modification
              • Drops file in Drivers directory
              • Event Triggered Execution: Image File Execution Options Injection
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks whether UAC is enabled
              • Sets desktop wallpaper using registry
              • Reads the TCP/IP host and domain name from the registry
              • Modifies Control Panel
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:3932
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
                7⤵
                • Indicator Removal: Clear Persistence
                • Suspicious use of WriteProcessMemory
                PID:904
                • C:\Windows\system32\schtasks.exe
                  schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
                  8⤵
                    PID:5704
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:616
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
                    8⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:704
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4980
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2920
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5744
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableIOAVProtection $true"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Loads dropped DLL
                  PID:5992
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisablePrivacyMode $true"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Loads dropped DLL
                  PID:3180
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -SignatureDisableUpdate $true"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Loads dropped DLL
                  PID:1972
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2124
                  • C:\Windows\system32\sc.exe
                    sc stop WinDefend
                    8⤵
                    • Launches sc.exe
                    PID:3516
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4360
                  • C:\Windows\system32\sc.exe
                    sc config WinDefend start=disabled
                    8⤵
                    • Launches sc.exe
                    PID:1144
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc stop SecurityHealthService
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4084
                  • C:\Windows\system32\sc.exe
                    sc stop SecurityHealthService
                    8⤵
                    • Launches sc.exe
                    PID:5980
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc config SecurityHealthService start=disabled
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1284
                  • C:\Windows\system32\sc.exe
                    sc config SecurityHealthService start=disabled
                    8⤵
                    • Launches sc.exe
                    PID:2336
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc stop WdFilter
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5620
                  • C:\Windows\system32\sc.exe
                    sc stop WdFilter
                    8⤵
                    • Launches sc.exe
                    PID:1696
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc config WdFilter start=disabled
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2888
                  • C:\Windows\system32\sc.exe
                    sc config WdFilter start=disabled
                    8⤵
                    • Launches sc.exe
                    PID:5820
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc stop WdNisDrv
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1048
                  • C:\Windows\system32\sc.exe
                    sc stop WdNisDrv
                    8⤵
                    • Launches sc.exe
                    PID:2484
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc config WdNisDrv start=disabled
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3736
                  • C:\Windows\system32\sc.exe
                    sc config WdNisDrv start=disabled
                    8⤵
                    • Launches sc.exe
                    PID:2832
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc stop WdNisSvc
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2836
                  • C:\Windows\system32\sc.exe
                    sc stop WdNisSvc
                    8⤵
                    • Launches sc.exe
                    PID:3660
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc config WdNisSvc start=disabled
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4648
                  • C:\Windows\system32\sc.exe
                    sc config WdNisSvc start=disabled
                    8⤵
                    • Launches sc.exe
                    PID:4912
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc stop WdBoot
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5280
                  • C:\Windows\system32\sc.exe
                    sc stop WdBoot
                    8⤵
                    • Launches sc.exe
                    PID:5720
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc config WdBoot start=disabled
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4160
                  • C:\Windows\system32\sc.exe
                    sc config WdBoot start=disabled
                    8⤵
                    • Launches sc.exe
                    PID:5080
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc stop MpsSvc
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4796
                  • C:\Windows\system32\sc.exe
                    sc stop MpsSvc
                    8⤵
                    • Launches sc.exe
                    PID:2540
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c sc config MpsSvc start=disabled
                  7⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3904
                  • C:\Windows\system32\sc.exe
                    sc config MpsSvc start=disabled
                    8⤵
                    • Launches sc.exe
                    PID:5944
                • C:\Windows\SYSTEM32\taskkill.exe
                  taskkill.exe /im Explorer.exe /f
                  7⤵
                  • Loads dropped DLL
                  • Kills process with taskkill
                  PID:2680
                • C:\Windows\SYSTEM32\wscript.exe
                  wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
                  7⤵
                  • Loads dropped DLL
                  • Executes a VBScript file via the Windows Script Host.
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:3556
                  • C:\Windows\system32\mspaint.exe
                    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\catcrypt_block.png"
                    8⤵
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    PID:4412
                • C:\Windows\SYSTEM32\wscript.exe
                  wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" cmd.exe /c attrib +h +s +r "%userprofile%\Desktop\!!!READ_ME!!!.txt" & attrib +h +s +r "%userprofile%\Documents\!!!READ_ME!!!.txt"
                  7⤵
                  • Loads dropped DLL
                  • Executes a VBScript file via the Windows Script Host.
                  • Hide Artifacts: Hidden Files and Directories
                  PID:5660
    • C:\Windows\Sub\RuntimeBroker.exe
      C:\Windows\Sub\RuntimeBroker.exe
      1⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3020
    • C:\Windows\Sub\xdwdRuntimeBroker.exe
      C:\Windows\Sub\xdwdRuntimeBroker.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:904
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:436
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
      • Loads dropped DLL
      PID:2356
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x0000000000000508
      1⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:5456
    • C:\Windows\explorer.exe
      explorer.exe ,"C:\Windows\system32\drivers\etc\svchost32.exe"
      1⤵
      • Loads dropped DLL
      PID:1284
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4952
    • C:\Windows\system32\drivers\etc\svchost32.exe
      C:\Windows\system32\drivers\etc\svchost32.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1104
    • C:\Windows\System32\userinit.exe
      C:\Windows\System32\userinit.exe
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:2968
      • C:\Windows\system32\drivers\etc\svchost32.exe
        "C:\Windows\system32\drivers\etc\svchost32.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2520
    • C:\Windows\Sub\RuntimeBroker.exe
      C:\Windows\Sub\RuntimeBroker.exe
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      PID:1652
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
      1⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      PID:5716
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:2780
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
        1⤵
          PID:1216

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              3
              T1059

              PowerShell

              1
              T1059.001

              Visual Basic

              1
              T1059.005

              Windows Command Shell

              1
              T1059.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              System Services

              1
              T1569

              Service Execution

              1
              T1569.002

              Persistence

              Boot or Logon Autostart Execution

              4
              T1547

              Active Setup

              1
              T1547.014

              Registry Run Keys / Startup Folder

              2
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Create or Modify System Process

              3
              T1543

              Windows Service

              3
              T1543.003

              Event Triggered Execution

              2
              T1546

              AppInit DLLs

              1
              T1546.010

              Image File Execution Options Injection

              1
              T1546.012

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Boot or Logon Autostart Execution

              4
              T1547

              Active Setup

              1
              T1547.014

              Registry Run Keys / Startup Folder

              2
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Create or Modify System Process

              3
              T1543

              Windows Service

              3
              T1543.003

              Event Triggered Execution

              2
              T1546

              AppInit DLLs

              1
              T1546.010

              Image File Execution Options Injection

              1
              T1546.012

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Deobfuscate/Decode Files or Information

              1
              T1140

              Hide Artifacts

              1
              T1564

              Hidden Files and Directories

              1
              T1564.001

              Impair Defenses

              4
              T1562

              Disable or Modify Tools

              3
              T1562.001

              Indicator Removal

              1
              T1070

              Clear Persistence

              1
              T1070.009

              Modify Registry

              9
              T1112

              Credential Access

              Discovery

              Peripheral Device Discovery

              1
              T1120

              Query Registry

              2
              T1012

              System Information Discovery

              3
              T1082

              System Network Configuration Discovery

              1
              T1016

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Defacement

              1
              T1491

              Service Stop

              1
              T1489

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 a0a38fa4a0bf711b40b4f5d515b4127180d4139620b90f7b3eed11b0e752d9f8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 fa45d29e0f6becce98d48742b09a746026f85a50847ec1f78b112b34c6e1da34
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 c92918e0d7a215d2cce28f7d8419d65f18d3118e1163cc89897537a44169d882
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 7554798c747c4d7272da555d1b3fdfa362c64e2f2aec0adc4a7f75a09f26a940
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              RatKiller.exe
              • Path C:\Users\Admin\AppData\Local\Temp\RatKiller.exe
              • Size 650KB
              • SHA256 c44f69790fa9d70102a802892b65fa4c55de770856e034500acf71b477374025
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __PSScriptPolicyTest_rmxgg2rk.2nt.psm1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rmxgg2rk.2nt.psm1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ftcetndd.1d2.exe
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ftcetndd.1d2.exe
              • Size 16.2MB
              • SHA256 949061914168c2c2b301472c6478b5d099774ed2aefcab1fd259b304c79762da
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BackupMount.jpg.pdr.tmp
              • Path C:\Users\Admin\Downloads\BackupMount.jpg.pdr.tmp
              • Size 449KB
              • SHA256 e68f83db7ee70365a085797f69761e3b285e30b899d49b49138c15ad4d4f5480
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PingGroup.jpg.pdr.tmp
              • Path C:\Users\Admin\Downloads\PingGroup.jpg.pdr.tmp
              • Size 909KB
              • SHA256 2c3ceb97a3bbbcd03d1ae60b886c495d163b1dc7f1e363ed2244fe47e2486ed7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ReadEnter.docx.pdr.tmp
              • Path C:\Users\Admin\Downloads\ReadEnter.docx.pdr.tmp
              • Size 407KB
              • SHA256 5e2895e9bc7994bce0ad9b7f6e2e3a1fe155ed83c961edb9528fed0c6b4ea88b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              $boot_marker.tmp
              • Path C:\Windows\system32\drivers\etc\$boot_marker.tmp
              • Size 9B
              • SHA256 b804e5fb40f955e3eb9592927c7ba2fd1fe6d40639937f40a11613a882b06b4e
              • MD5 SHA1 SHA512
              Submit Download

              xdwd.dll
              • Path C:\Windows\xdwd.dll
              • Size 136KB
              • SHA256 7439711d5b9402063393c1b449acf310c58963db13e8658187e49bd01cf1c30f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/436-92-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/436-327-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/436-81-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/904-78-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/904-82-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/1104-160-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/1104-163-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/1216-329-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/1284-153-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/1284-146-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/1972-210-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/1972-217-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2356-89-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2356-91-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2520-238-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2520-233-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2680-239-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2680-235-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2696-109-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2696-112-0x000001D2656C0000-0x000001D2656E2000-memory.dmp
              Download

              memory/2696-116-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2780-330-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2780-328-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2920-169-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2920-176-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2936-231-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2936-326-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2936-323-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2968-322-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/2968-234-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/3180-207-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/3180-200-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/3556-240-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/3556-232-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/3932-168-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/3932-135-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/4412-324-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/4412-241-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/4848-88-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-14-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-98-0x000000001AE10000-0x000000001AE96000-memory.dmp
              Download

              memory/4848-4-0x00007FF97F35F000-0x00007FF97F360000-memory.dmp
              Download

              memory/4848-97-0x000000001BA90000-0x000000001BAAE000-memory.dmp
              Download

              memory/4848-96-0x000000001C9F0000-0x000000001CB36000-memory.dmp
              Download

              memory/4848-5-0x0000000000100000-0x00000000001A8000-memory.dmp
              Download

              memory/4848-95-0x000000001C430000-0x000000001C4A6000-memory.dmp
              Download

              memory/4848-6-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-7-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-8-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-90-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-9-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-10-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-86-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-103-0x000000001A440000-0x000000001A44C000-memory.dmp
              Download

              memory/4848-11-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-85-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-84-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-43-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-12-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-13-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
              Download

              memory/4848-102-0x000000001CD30000-0x000000001CDB2000-memory.dmp
              Download

              memory/4952-148-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/4952-185-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/4952-237-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/4980-165-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/4980-157-0x000001A9D8460000-0x000001A9D8512000-memory.dmp
              Download

              memory/4980-156-0x000001A9C0100000-0x000001A9C011E000-memory.dmp
              Download

              memory/4980-162-0x000001A9C00F0000-0x000001A9C00FA000-memory.dmp
              Download

              memory/4980-145-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/5456-101-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/5456-100-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/5660-317-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/5660-321-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/5716-325-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/5716-320-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/5744-187-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/5744-179-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/5992-190-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/5992-197-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/6008-119-0x00000000005C0000-0x00000000015F0000-memory.dmp
              Download

              memory/6008-134-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download

              memory/6008-118-0x00007FF98A180000-0x00007FF98A1A2000-memory.dmp
              Download