@Eli Ofek 
As per your suggestion, i downloaded the excel file from portal, checked network activities. 
It says that kerberos was used and Error reason is 'Pre-authentication failed', Destination Port: 88, Destination is a Domain Controller. Please check the attachment(Original details changed)

End point solution logs says that connection was initiated from the server(Server_A) to domain controller(DC00001) over port 88.  At the same time the user tried to RDP to that server(Server_A), from his Computer, over port 3389, he was using mremote. But he never faced any error while login or any incorrect password error. 

In case if there was a malware, how do i proceed for further investigation?

We support Ukraine and condemn war. Push Russian government to act against war. Be brave, vocal and show your support to Ukraine. Follow the latest news HERE