Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, %TEMP%\dllruntime\netsession.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, %TEMP%\dllruntime\netsession.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- <SYSTEM32>\tasks\b4a0f4512f6cd43d638a5f8a27c338ad
Modifies file system
Creates the following files
- %TEMP%\dllruntime\zimywpzvcj9vl9z0dck4.exe
- %TEMP%\dclib\antiwindowsdefender.dclib
- %TEMP%\dclib\antivm.dclib
- %TEMP%\dclib\ak_33db8088017dd3ba0d1f7d0d6d211cb82b9f06dd.dclib
- %TEMP%\dllruntime\system.lnk
- %TEMP%\dllruntime\system.vbe
- %TEMP%\dllruntime\netsession.exe
- %TEMP%\dllruntime\vmcheck32.dll
- %TEMP%\dclib\as_c07f7472ed0469e66b90bea3f8afee0ab215080e.dclib
- %TEMP%\dllruntime\p6zsewo3g99z8w3uhquyllysqfuoyp.bat
- %TEMP%\dllruntime\dclib\rs2300f068121707def35df4f7b5d2bc8a016bd37f.dclib
- %TEMP%\dllruntime\dclib\as_c07f7472ed0469e66b90bea3f8afee0ab215080e.dclib
- %TEMP%\dllruntime\dclib\antiwindowsdefender.dclib
- %TEMP%\dllruntime\dclib\antivm.dclib
- %TEMP%\dllruntime\dclib\ak_33db8088017dd3ba0d1f7d0d6d211cb82b9f06dd.dclib
- %TEMP%\dllruntime\sfku8qiv45rizvwcdtzlndp2swuhux.bat
- %TEMP%\dllruntime\3znvcyqbbhy0sormgsua9wfz8sdl5i.vbs
- %TEMP%\dllruntime\e6ee5674bb9446c78bbc5729af6e2c28.exe
- %TEMP%\dclib\rs2300f068121707def35df4f7b5d2bc8a016bd37f.dclib
Network activity
TCP
HTTP GET requests
- http://fu########it332.000webhostapp.com/yomsnlbjepur2bkn6wjb0c98lnzlf2rg0e04ykg2cq4miezial7r8j4pyu/voockqcb9ima0qrmvc3llw7tthe4mu6g3ib8ygnz76v31mjtu6onc65fvhbz022d/9c9c819273f74bafbff5e6105faa...
- http://fu########it332.000webhostapp.com/yomsnlbjepur2bkn6wjb0c98lnzlf2rg0e04ykg2cq4miezial7r8j4pyu/voockqcb9ima0qrmvc3llw7tthe4mu6g3ib8ygnz76v31mjtu6onc65fvhbz022d/kv0gvp1wmz7e95cw12ttsrqowdi8...
- http://ip##fo.io/ip
UDP
- DNS ASK fu########it332.000webhostapp.com
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\dllruntime\3ZNVCyQBbhY0SOrMgsUa9WFz8sdL5i.vbs"
- '%TEMP%\dllruntime\zimywpzvcj9vl9z0dck4.exe' -p1a98000839871975a93885ce5e1af2c7e4426e34
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\dllruntime\System.vbe"
- '%TEMP%\dllruntime\e6ee5674bb9446c78bbc5729af6e2c28.exe'
- '%TEMP%\dllruntime\netsession.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\dllruntime\sFku8qiv45RiZVWcdtzLndP2sWUhux.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\dllruntime\p6ZseWo3g99z8W3UhQuyllYSQFuoYP.bat" "' (with hidden window)
- '%TEMP%\dllruntime\e6ee5674bb9446c78bbc5729af6e2c28.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\dllruntime\sFku8qiv45RiZVWcdtzLndP2sWUhux.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\dllruntime\p6ZseWo3g99z8W3UhQuyllYSQFuoYP.bat" "
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose
