Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\AdobeFlashPlayerControlSvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\AdobeFlashPlayerControlSvc] 'ImagePath' = 'C:\ProgramData\GS_Svc.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\AdobeFlashPlayerHash] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\AdobeFlashPlayerHash] 'ImagePath' = '%WINDIR%\parameters\hostdll.exe'
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\taskkill.exe' /F /im SMSvHost.exe
- '<SYSTEM32>\taskkill.exe' /F /im Rundll.exe
- '<SYSTEM32>\taskkill.exe' /F /im cmd.exe
- '<SYSTEM32>\net.exe' stop AdobeFlashPlayerHash
- '<SYSTEM32>\net.exe' stop AdobeFlashPlayerControlSvc
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system:
Creates the following files:
- C:\ProgramData\Microsoft\Windows\Rundll\Rundll.7z
- C:\ProgramData\ModuleGS\7zip\7z.exe
- C:\ProgramData\ModuleGS\7zip\7z.dll
- <SYSTEM32>\SMSvHost.exe
- C:\ProgramData\Microsoft\Windows\Rundll\7z.exe
- C:\ProgramData\Microsoft\Windows\Rundll\7z.dll
- %WINDIR%\Installer\PatchCach\SystemNT.exe
- %WINDIR%\parameters\hostdll.exe
- %WINDIR%\parameters\parameters.ini
- C:\ProgramData\GS_Svc.exe
- C:\ProgramData\svhost.exe
- C:\ProgramData\setting.ini
Network activity:
Connects to:
- 'mi##.##rabotaibitok.ru':80
TCP:
HTTP GET requests:
- http://mi##.##rabotaibitok.ru/Downloads/Rundll/7z.dll
- http://mi##.##rabotaibitok.ru/Downloads/KM_GS/GS_Svc.exe
- http://mi##.##rabotaibitok.ru/Downloads/Rundll/7z.exe
- http://mi##.##rabotaibitok.ru/Downloads/Rundll/add_service/X86/SMSvHost.exe
- http://mi##.##rabotaibitok.ru/Downloads/Rundll/Rundll.7z
- http://mi##.##rabotaibitok.ru/Downloads/KM_HS/hostdll.exe
- http://mi##.##rabotaibitok.ru/Downloads/KM_HS/parameters.ini
- http://mi##.##rabotaibitok.ru/Downloads/Miner_Xmrig/X86/SystemNT.exe
- http://mi##.##rabotaibitok.ru/Downloads/KM_GS/svhost.exe
- http://mi##.##rabotaibitok.ru/Downloads/KM_GS/setting.ini
UDP:
- DNS ASK mi##.##rabotaibitok.ru
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
Creates and executes the following:
- 'C:\ProgramData\Microsoft\Windows\Rundll\7z.exe' e C:\ProgramData\Microsoft\Windows\Rundll\Rundll.7z -y -oC:\ProgramData\Microsoft\Windows\Rundll
- '<SYSTEM32>\SMSvHost.exe' install clr_optimization_v4.0.18957_x64 "C:\ProgramData\Microsoft\Windows\Rundll\Rundll.exe
- '%WINDIR%\parameters\hostdll.exe'
- 'C:\ProgramData\GS_Svc.exe'
Executes the following:
- '<SYSTEM32>\sc.exe' delete clr_optimization_v4.0.18957_x64
- '<SYSTEM32>\sc.exe' stop windefend
- '<SYSTEM32>\net1.exe' start AdobeFlashPlayerControlSvc
- '<SYSTEM32>\sc.exe' stop clr_optimization_v4.0.18957_x64
- '<SYSTEM32>\sc.exe' delete windefend
- '<SYSTEM32>\sc.exe' config clr_optimization_v4.0.18957_x64 DisplayName= "Microsoft .NET Framework NGEN v4.0.18957_x64"
- '<SYSTEM32>\sc.exe' start clr_optimization_v4.0.18957_x64
- '<SYSTEM32>\cmd.exe' /k C:\ProgramData\Microsoft\Windows\Rundll\7z.exe e C:\ProgramData\Microsoft\Windows\Rundll\Rundll.7z -y -oC:\ProgramData\Microsoft\Windows\Rundll
- '<SYSTEM32>\sc.exe' description clr_optimization_v4.0.18957_x64 "Microsoft .NET Framework NGEN"
- '<SYSTEM32>\sc.exe' create AdobeFlashPlayerHash binpath= %WINDIR%\parameters\hostdll.exe start= auto
- '<SYSTEM32>\net.exe' start AdobeFlashPlayerHash
- '<SYSTEM32>\sc.exe' delete AdobeFlashPlayerHash
- '<SYSTEM32>\net1.exe' stop AdobeFlashPlayerHash
- '<SYSTEM32>\net1.exe' start AdobeFlashPlayerHash
- '<SYSTEM32>\sc.exe' create AdobeFlashPlayerControlSvc binpath= C:\ProgramData\GS_Svc.exe start= auto
- '<SYSTEM32>\net.exe' start AdobeFlashPlayerControlSvc
- '<SYSTEM32>\sc.exe' delete AdobeFlashPlayerControlSvc
- '<SYSTEM32>\net1.exe' stop AdobeFlashPlayerControlSvc
