Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Realtek HD Audio' = 'C:\ProgramData\RealtekHD\taskhostw.exe'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- C:\programdata\windowstask\scaner.dat
- C:\programdata\rundll\vcruntime140.dll
- C:\programdata\rundll\vcomp140.dll
- C:\programdata\rundll\vccorlib140.dll
- C:\programdata\rundll\vcamp140.dll
- C:\programdata\rundll\ucrtbase.dll
- C:\programdata\rundll\ucl.dll
- C:\programdata\rundll\tucl-1.dll
- C:\programdata\rundll\tucl.dll
- C:\programdata\rundll\trfo-2.dll
- C:\programdata\rundll\trfo-0.dll
- C:\programdata\rundll\trfo.dll
- C:\programdata\rundll\trch-1.dll
- C:\programdata\rundll\trch-0.dll
- C:\programdata\rundll\x64.dll
- C:\programdata\rundll\trch.dll
- C:\programdata\rundll\tibe-1.dll
- C:\programdata\rundll\tibe.dll
- C:\programdata\rundll\system.exe
- C:\programdata\rundll\start.vbs
- C:\programdata\rundll\start.exe
- C:\programdata\rundll\ssleay32.dll
- C:\programdata\rundll\scan.txt
- C:\programdata\rundll\rundll.exe
- C:\programdata\rundll\riar-2.dll
- C:\programdata\rundll\riar.dll
- C:\programdata\rundll\posh-0.dll
- C:\programdata\rundll\posh.dll
- C:\programdata\rundll\pcreposix-0.dll
- C:\programdata\rundll\tibe-2.dll
- C:\programdata\rundll\x86.dll
- C:\programdata\rundll\xdvl-0.dll
- C:\programdata\rundll\zibe.dll
- C:\programdata\rundll\api-ms-win-core-file-l1-2-0.dll
- C:\programdata\rundll\adfw-2.dll
- C:\programdata\rundll\adfw.dll
- C:\programdata\rundll\2x86.dll
- C:\programdata\rundll\2x64.dll
- C:\programdata\rundll\system32\api-ms-win-eventing-provider-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-utility-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-time-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-string-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-stdio-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-runtime-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-process-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-private-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-multibyte-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-math-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-locale-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-heap-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-filesystem-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-environment-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-convert-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-crt-conio-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-core-xstate-l2-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-core-timezone-l1-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-core-synch-l1-2-0.dll
- C:\programdata\rundll\system32\api-ms-win-core-processthreads-l1-1-1.dll
- C:\programdata\rundll\system32\api-ms-win-core-localization-l1-2-0.dll
- C:\programdata\rundll\system32\api-ms-win-core-file-l2-1-0.dll
- C:\programdata\rundll\system32\api-ms-win-core-file-l1-2-0.dll
- C:\programdata\rundll\zlib1.dll
- C:\programdata\rundll\pcrecpp-0.dll
- C:\programdata\rundll\api-ms-win-core-file-l2-1-0.dll
- C:\programdata\rundll\pcre-0.dll
- C:\programdata\rundll\msvcp140.dll
- C:\programdata\rundll\dmgd-4.dll
- C:\programdata\rundll\dmgd-1.dll
- C:\programdata\rundll\crli-0.dll
- C:\programdata\rundll\concrt140.dll
- C:\programdata\rundll\coli-0.dll
- C:\programdata\rundll\cnli-1.dll
- C:\programdata\rundll\cnli-0.dll
- C:\programdata\rundll\api-ms-win-eventing-provider-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-utility-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-time-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-string-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-stdio-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-runtime-l1-1-0.dll
- C:\programdata\rundll\doublepulsar-1.3.1.exe
- C:\programdata\rundll\api-ms-win-crt-process-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-multibyte-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-math-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-locale-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-heap-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-filesystem-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-environment-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-convert-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-conio-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-core-xstate-l2-1-0.dll
- C:\programdata\rundll\api-ms-win-core-timezone-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-core-synch-l1-2-0.dll
- C:\programdata\rundll\api-ms-win-core-processthreads-l1-1-1.dll
- C:\programdata\rundll\api-ms-win-core-localization-l1-2-0.dll
- C:\programdata\rundll\api-ms-win-crt-private-l1-1-0.dll
- C:\programdata\rundll\doublepulsar-1.3.1.skeleton.xml
- C:\programdata\rundll\doublepulsar-1.3.1.xml
- C:\programdata\rundll\esco-0.dll
- C:\programdata\rundll\mfcm140u.dll
- C:\programdata\rundll\mfcm140.dll
- C:\programdata\rundll\mfc140rus.dll
- C:\programdata\rundll\mfc140kor.dll
- C:\programdata\rundll\mfc140jpn.dll
- C:\programdata\rundll\mfc140ita.dll
- C:\programdata\rundll\mfc140fra.dll
- C:\programdata\rundll\mfc140esn.dll
- C:\programdata\rundll\mfc140enu.dll
- C:\programdata\rundll\mfc140deu.dll
- C:\programdata\rundll\mfc140cht.dll
- C:\programdata\rundll\mfc140chs.dll
- C:\programdata\rundll\libxml2.dll
- C:\programdata\rundll\libiconv-2.dll
- C:\programdata\rundll\libeay32.dll
- C:\programdata\rundll\libcurl.dll
- C:\programdata\rundll\iconv.dll
- C:\programdata\rundll\exma-1.dll
- C:\programdata\rundll\exma.dll
- C:\programdata\rundll\eternalblue-2.2.0.xml
- C:\programdata\rundll\eternalblue-2.2.0.skeleton.xml
- C:\programdata\rundll\eternalblue-2.2.0.fb
- C:\programdata\rundll\eternalblue-2.2.0.exe
- C:\programdata\rundll\etebcore-2.x86.dll
- C:\programdata\rundll\etebcore-2.x64.dll
- C:\programdata\rundll\eteb-2.dll
- C:\programdata\rundll\etchcore-0.x86.dll
- C:\programdata\rundll\etchcore-0.x64.dll
- C:\programdata\rundll\etch-0.dll
- C:\programdata\rundll\pcla-0.dll
- C:\programdata\windowstask\appservice.dat
Sets the 'hidden' attribute to the following files
- C:\programdata\windowstask\scaner.dat
- C:\programdata\rundll\scan.txt
- C:\programdata\rundll\rundll.exe
- C:\programdata\rundll\riar.dll
- C:\programdata\rundll\riar-2.dll
- C:\programdata\rundll\posh.dll
- C:\programdata\rundll\posh-0.dll
- C:\programdata\rundll\pcreposix-0.dll
- C:\programdata\rundll\pcrecpp-0.dll
- C:\programdata\rundll\pcre-0.dll
- C:\programdata\rundll\pcla-0.dll
- C:\programdata\rundll\msvcp140.dll
- C:\programdata\rundll\mfcm140u.dll
- C:\programdata\rundll\mfcm140.dll
- C:\programdata\rundll\mfc140rus.dll
- C:\programdata\rundll\mfc140kor.dll
- C:\programdata\rundll\mfc140jpn.dll
- C:\programdata\rundll\mfc140ita.dll
- C:\programdata\rundll\mfc140fra.dll
- C:\programdata\rundll\mfc140esn.dll
- C:\programdata\rundll\mfc140enu.dll
- C:\programdata\rundll\mfc140deu.dll
- C:\programdata\rundll\mfc140cht.dll
- C:\programdata\rundll\mfc140chs.dll
- C:\programdata\rundll\libiconv-2.dll
- C:\programdata\rundll\libxml2.dll
- C:\programdata\rundll\ssleay32.dll
- C:\programdata\rundll\start.exe
- C:\programdata\rundll\zlib1.dll
- C:\programdata\rundll\zibe.dll
- C:\programdata\rundll\xdvl-0.dll
- C:\programdata\rundll\x86.dll
- C:\programdata\rundll\x64.dll
- C:\programdata\rundll\vcruntime140.dll
- C:\programdata\rundll\vcomp140.dll
- C:\programdata\rundll\vccorlib140.dll
- C:\programdata\rundll\vcamp140.dll
- C:\programdata\rundll\ucrtbase.dll
- C:\programdata\rundll\ucl.dll
- C:\programdata\rundll\tucl-1.dll
- C:\programdata\rundll\esco-0.dll
- C:\programdata\rundll\trfo.dll
- C:\programdata\rundll\trfo-2.dll
- C:\programdata\rundll\trfo-0.dll
- C:\programdata\rundll\trch.dll
- C:\programdata\rundll\trch-1.dll
- C:\programdata\rundll\trch-0.dll
- C:\programdata\rundll\tibe.dll
- C:\programdata\rundll\tibe-2.dll
- C:\programdata\rundll\tibe-1.dll
- C:\programdata\rundll\system.exe
- C:\programdata\rundll\start.vbs
- C:\programdata\rundll\libeay32.dll
- C:\programdata\rundll\libcurl.dll
- C:\programdata\rundll\iconv.dll
- C:\programdata\rundll\api-ms-win-crt-process-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-private-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-multibyte-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-math-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-locale-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-heap-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-filesystem-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-environment-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-convert-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-conio-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-core-xstate-l2-1-0.dll
- C:\programdata\rundll\api-ms-win-core-timezone-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-core-synch-l1-2-0.dll
- C:\programdata\rundll\api-ms-win-core-processthreads-l1-1-1.dll
- C:\programdata\rundll\api-ms-win-core-localization-l1-2-0.dll
- C:\programdata\rundll\api-ms-win-core-file-l2-1-0.dll
- C:\programdata\rundll\api-ms-win-core-file-l1-2-0.dll
- C:\programdata\rundll\adfw.dll
- C:\programdata\rundll\adfw-2.dll
- C:\programdata\rundll\2x86.dll
- C:\programdata\rundll\2x64.dll
- C:\programdata\windowstask\scaner.exe
- C:\programdata\rundll\api-ms-win-crt-stdio-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-string-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-runtime-l1-1-0.dll
- C:\programdata\rundll\api-ms-win-crt-time-l1-1-0.dll
- C:\programdata\rundll\exma.dll
- C:\programdata\rundll\api-ms-win-crt-utility-l1-1-0.dll
- C:\programdata\rundll\exma-1.dll
- C:\programdata\rundll\eternalblue-2.2.0.xml
- C:\programdata\rundll\eternalblue-2.2.0.skeleton.xml
- C:\programdata\rundll\eternalblue-2.2.0.fb
- C:\programdata\rundll\eternalblue-2.2.0.exe
- C:\programdata\rundll\etebcore-2.x86.dll
- C:\programdata\rundll\etebcore-2.x64.dll
- C:\programdata\rundll\eteb-2.dll
- C:\programdata\rundll\etchcore-0.x86.dll
- C:\programdata\rundll\etchcore-0.x64.dll
- C:\programdata\rundll\tucl.dll
- C:\programdata\windowstask\appservice.dat
- C:\programdata\rundll\doublepulsar-1.3.1.xml
- C:\programdata\rundll\doublepulsar-1.3.1.skeleton.xml
- C:\programdata\rundll\doublepulsar-1.3.1.exe
- C:\programdata\rundll\dmgd-4.dll
- C:\programdata\rundll\dmgd-1.dll
- C:\programdata\rundll\crli-0.dll
- C:\programdata\rundll\concrt140.dll
- C:\programdata\rundll\coli-0.dll
- C:\programdata\rundll\cnli-1.dll
- C:\programdata\rundll\cnli-0.dll
- C:\programdata\rundll\api-ms-win-eventing-provider-l1-1-0.dll
- C:\programdata\rundll\etch-0.dll
- C:\programdata\windowstask\appservice.exe
Deletes the following files
- C:\programdata\windowstask\scaner.exe
Moves the following files
- from C:\programdata\windowstask\scaner.dat to C:\programdata\windowstask\scaner.exe
- from C:\programdata\windowstask\appservice.dat to C:\programdata\windowstask\appservice.exe
Substitutes the following files
- %HOMEPATH%\ntuser.pol
Network activity
TCP
HTTP GET requests
- http://xx###llout.com/system/diff.html
- http://xx###llout.com/system/mod.html
- http://xx###llout.com/system/loader.html
- http://xx###llout.com/system/Login.html
- http://xx###llout.com/system/Password.html
- http://xx###llout.com/system/Server.html
- http://xx###llout.com/system/xmrigCPU.html
- http://xx###llout.com/system/configCPU.html
- http://xx###llout.com/system/STATUS.html
- http://xx###llout.com/system/block.txt
UDP
- DNS ASK xx###llout.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- 'C:\programdata\windowstask\scaner.exe' -pnaxui
- 'C:\programdata\rundll\start.exe'
- '<SYSTEM32>\wscript.exe' "C:\Programdata\RunDLL\start.vbs"
- 'C:\programdata\rundll\rundll.exe'
- '<SYSTEM32>\cmd.exe' /c ipconfig /flushdns' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\local\akamai /deny Администраторы:(OI)(CI)(F)' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\local\akamai /deny System:(OI)(CI)(F)' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\local\akamai /deny %username%:(OI)(CI)(F)' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ATTRIB +H +S %HOMEPATH%\appdata\local\akamai' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c mkdir %HOMEPATH%\appdata\local\akamai' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\roaming\NsCpuCNMiner /deny Администраторы:(OI)(CI)(F)' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\roaming\NsCpuCNMiner /deny System:(OI)(CI)(F)' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c mkdir %HOMEPATH%\appdata\roaming\NsCpuCNMiner' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\local\Tempo /deny Администраторы:(OI)(CI)(F)' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ATTRIB +H +S %HOMEPATH%\appdata\roaming\NsCpuCNMiner' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c mkdir %HOMEPATH%\AppData\local\Temp\csrss' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\local\Tempo /deny System:(OI)(CI)(F)' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\local\Tempo /deny %username%:(OI)(CI)(F)' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ATTRIB +H +S %HOMEPATH%\appdata\local\Tempo' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c mkdir %HOMEPATH%\appdata\local\Tempo' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "system.exe TCP 192.168.1.1 445 150 /save"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c Rundll.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c gpupdate /force' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\roaming\NsCpuCNMiner /deny %username%:(OI)(CI)(F)' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ATTRIB +H +S %HOMEPATH%\AppData\local\Temp\csrss' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ipconfig /flushdns
- '<SYSTEM32>\cmd.exe' /c mkdir %HOMEPATH%\AppData\local\Temp\csrss
- '<SYSTEM32>\attrib.exe' +H +S C:\users\user\appdata\local\akamai
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\local\akamai /deny Администраторы:(OI)(CI)(F)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\local\akamai /deny System:(OI)(CI)(F)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\local\akamai /deny %username%:(OI)(CI)(F)
- '<SYSTEM32>\cmd.exe' /c ATTRIB +H +S %HOMEPATH%\appdata\local\akamai
- '<SYSTEM32>\cmd.exe' /c mkdir %HOMEPATH%\appdata\local\akamai
- '<SYSTEM32>\attrib.exe' +H +S c:\users\user\appdata\roaming\NsCpuCNMiner
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\roaming\NsCpuCNMiner /deny Администраторы:(OI)(CI)(F)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\roaming\NsCpuCNMiner /deny System:(OI)(CI)(F)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\roaming\NsCpuCNMiner /deny %username%:(OI)(CI)(F)
- '<SYSTEM32>\cmd.exe' /c ATTRIB +H +S %HOMEPATH%\AppData\local\Temp\csrss
- '<SYSTEM32>\cmd.exe' /c ATTRIB +H +S %HOMEPATH%\appdata\roaming\NsCpuCNMiner
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\local\Tempo /deny Администраторы:(OI)(CI)(F)
- '<SYSTEM32>\attrib.exe' +H +S C:\users\user\appdata\local\Tempo
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\local\Tempo /deny System:(OI)(CI)(F)
- '<SYSTEM32>\cmd.exe' /c icacls %HOMEPATH%\appdata\local\Tempo /deny %username%:(OI)(CI)(F)
- '<SYSTEM32>\cmd.exe' /c ATTRIB +H +S %HOMEPATH%\appdata\local\Tempo
- '<SYSTEM32>\cmd.exe' /c mkdir %HOMEPATH%\appdata\local\Tempo
- '<SYSTEM32>\cmd.exe' /c "system.exe TCP 192.168.1.1 445 150 /save"
- '<SYSTEM32>\cmd.exe' /c Rundll.exe
- '<SYSTEM32>\gpupdate.exe' /force
- '<SYSTEM32>\cmd.exe' /c gpupdate /force
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '<SYSTEM32>\cmd.exe' /c mkdir %HOMEPATH%\appdata\roaming\NsCpuCNMiner
- '<SYSTEM32>\attrib.exe' +H +S C:\USERS\user\AppData\local\Temp\csrss
