Analysis
-
max time kernel
117s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
07-04-2023 16:05
General
-
Target
NoSleep.dll
-
Size
1.1MB
-
MD5
f52363b6cf282669e5fcc5537b5c3451
-
SHA1
9d9a0b90042fce790ab23191be9cce44c86f13d9
-
SHA256
b803db527f146f0d356700e24836a2e888f74c3dd2196a99f73caa0e57007f34
-
SHA512
d129f4f67691d9042e0bd0d94fabdecf96cadc33d15a662d1910bbb6bbf807eb73cc907f9268aaf99c7680a34d4088b3e79da8cff2dda7f12bc1ba95b44b6b49
-
SSDEEP
24576:QE8EsBM3ye//mFqTRBb5g795RgYM6y0Mblfi9gqKnh6QceWh04Bcc1f9NKG7YNjv:o1QtD895Rf1vxSGhe29NXYNj/B7j3J
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NoSleep.dll,#11⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken