5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d

General

Target

5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
Size

74KB
MD5

95f0327d26ea34d88c34ba0374d96f31
SHA1

4276f0f1d258a4d65e17665eb4de4970fc1c5cd9
SHA256

5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d
SHA512

d768d3ac9e5780ed63f5430f02d10af5ffbe0d7f066b0f22e13b9839af4a6de4b44b7ac6ca5f5b0e61b75ced2a3fc59c62b11a4001b07aace7f2592905dc2fa9
SSDEEP

1536:/m5I1pfBlTygdtMFyMQUZDBKafTpHfLjva+x9rru4zJpCcS:O5odtcyMQUZDBKaRjjvaO9rzJpCt

Score

1^/10

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2040 schtasks.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

TASKKILL.exeTASKKILL.exe

pid process

1812 TASKKILL.exe
2036 TASKKILL.exe

pid	process
2040	schtasks.exe

pid	process
1812	TASKKILL.exe
2036	TASKKILL.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe

pid	process
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exeTASKKILL.exeTASKKILL.exe

description	pid	process
Token: SeDebugPrivilege	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
Token: SeDebugPrivilege	2036	TASKKILL.exe
Token: SeDebugPrivilege	1812	TASKKILL.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe

description	pid	process	target process
PID 1028 wrote to memory of 1372	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	schtasks.exe
PID 1028 wrote to memory of 1372	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	schtasks.exe
PID 1028 wrote to memory of 1372	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	schtasks.exe
PID 1028 wrote to memory of 1372	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	schtasks.exe
PID 1028 wrote to memory of 2040	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	schtasks.exe
PID 1028 wrote to memory of 2040	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	schtasks.exe
PID 1028 wrote to memory of 2040	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	schtasks.exe
PID 1028 wrote to memory of 2040	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	schtasks.exe
PID 1028 wrote to memory of 1812	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	TASKKILL.exe
PID 1028 wrote to memory of 1812	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	TASKKILL.exe
PID 1028 wrote to memory of 1812	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	TASKKILL.exe
PID 1028 wrote to memory of 1812	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	TASKKILL.exe
PID 1028 wrote to memory of 2036	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	TASKKILL.exe
PID 1028 wrote to memory of 2036	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	TASKKILL.exe
PID 1028 wrote to memory of 2036	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	TASKKILL.exe
PID 1028 wrote to memory of 2036	1028	5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe	TASKKILL.exe

C:\Users\Admin\AppData\Local\Temp\5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe
"C:\Users\Admin\AppData\Local\Temp\5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYANP /F
2⤵
PID:1372

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\5238bda5d2a35525c043b2140f9e80ff30045b5230d07a87436606fb2d606a6d.exe" /sc minute /mo 5
2⤵
- Creates scheduled task(s)
PID:2040

C:\Windows\SysWOW64\TASKKILL.exe
TASKKILL /F /IM wscript.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1812

C:\Windows\SysWOW64\TASKKILL.exe
TASKKILL /F /IM cmd.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2036

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1028-56-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/1028-60-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/1028-61-0x0000000000375000-0x0000000000386000-memory.dmp

Filesize
68KB

Download
memory/1028-62-0x0000000000375000-0x0000000000386000-memory.dmp

Filesize
68KB

Download
memory/1372-55-0x0000000000000000-mapping.dmp

Download
memory/1812-58-0x0000000000000000-mapping.dmp

Download
memory/2036-59-0x0000000000000000-mapping.dmp

Download
memory/2040-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads