Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Windows Update' = '"<LS_APPDATA>\HuIokmGHYU\crss.exe"'
Malicious functions:
Injects code into
the following user processes:
- dllhost.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system:
Creates the following files:
- <LS_APPDATA>\HuIokmGHYU\crss.exe
- %TEMP%\dllhost.exe
Miscellaneous:
Creates and executes the following:
- '%TEMP%\dllhost.exe'
Executes the following:
- '<SYSTEM32>\svchost.exe' -a cryptonight -o stratum+tcp://xmr.pool.minergate.com:45560 -u systemupdates@protonmail.ch -p x -t 2
- '<SYSTEM32>\cmd.exe'
