The Problem

So like a week, my cursor started to act weird whenever I tried open a browser. My cursor kept on going to busy state to normal every 5-10 seconds. Since I had a very outdated Chrome browser, I thought that some extension would be doing this or maybe some update was trying to happen. Switched to Firefox browser, same thing happened. And then I opened the task manager and found out that a .tmp was showing up often with weird names like ~131E.tmp and disappearing every 5-10 seconds. Feeling suspicious, I then went to my %temp% directory and found a few .tmp files there.

How I Came To Know

I only came to know that it was a malware until I saw functions like VirtualAlloc, GetModuleHandleA, WriteProcessMemory, HeapAlloc by opening it in a hex editor.

By looking at this part of our .tmp this was where things started to get a little bit spooky.

KERNEL32��������GetProcAddress��LoadLibraryA����OutputDebugStringW
and 
VirtualAlloc��„GetModuleHandleA��¼GetProcAddress��¼VirtualAllocEx��
WriteProcessMemory��ð�CreateRemoteThread��ËWaitForSingleObject�Ž�CloseHandle�¾VirtualFree�éGetCommandLineW�ÁGetProcessHeap��Ó�CreateFileMappingW��ÞMapViewOfFile�OpenProcess�£UnmapViewOfFile�)GetCurrentProcess�~TerminateProcess��VHeapAlloc�ZHeapFree��ïMultiByteToWideChar�KERNEL32.dll

How I Removed It

Most of the malwares that affect you try to stay hidden in your PC in guise of legitimate software names. However this malware that tried to attack me was poorly crafted lmao and it was named as dplaptIn.exe which doesn’t sound like an app name that targets normal users. After running the following command which lets us know about softwares that are automatically started after the computer is turned on, I found where it was hiding.

reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

The directory of that poorly crafted malware :

compfmon    REG_SZ    C:\Users\%USERNAME%\AppData\Roaming\netconf\dplaptIn.exe

Ran regedit real quick, removed the registry value and finally removed the malware from the directory.

What I Think It Was Trying

I am not a reverse engineer but when I tried to inspect the malware, what I guessed was it was either trying to execute with the help of browser or tried to inject the payload onto the browser to steal some sensitve information.

At the time of writing this post, I ran a scan on both .tmp file and the real executable:

The number of anti-viruses that flagged these tells us enough.

Thankfully windows Antimalware Service Executable was the one which I am pretty sure that saved my one and only laptop from being infected. And this happened after I gave my laptop to someone during a class presentation lol.

Moral Of The Story: Keep your laptop with yourself.