Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\rundll32.exe
the following user processes:
- 2620.exe
Modifies file system
Creates the following files
- %TEMP%\nsbee40.tmp
- %TEMP%\4366.exe
- %TEMP%\~210364.tmp
- %TEMP%\2620.exe
- %TEMP%\bmf747.tmp
Deletes the following files
- %TEMP%\4366.exe
- %TEMP%\~210364.tmp
- %TEMP%\2620.exe
Network activity
Connects to
- '20#.#6.232.49':80
Miscellaneous
Creates and executes the following
- '%TEMP%\4366.exe'
- '%TEMP%\2620.exe'
- '%WINDIR%\syswow64\cmd.exe' /C SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && DEL "%TEMP%\4366.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' shell32.dll,Control_RunDLL
- '%WINDIR%\syswow64\cmd.exe' /C SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && SYSTEMINFO && DEL "%TEMP%\4366.exe"
- '%WINDIR%\syswow64\systeminfo.exe'
