Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\notepad
- <SYSTEM32>\tasks\winrar archiver auto update scheduler
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im "wrarupd.exe"
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\vens.exe
- %TEMP%\rarsfx0\winrarx64.exe
- %TEMP%\is-slqjf.tmp\winrarx64.tmp
- %TEMP%\is-huo1b.tmp\_isetup\_setup64.tmp
- %TEMP%\is-huo1b.tmp\idp.dll
- %TEMP%\is-976fc.tmp\winrarx64.tmp
- %TEMP%\is-2qodv.tmp\_isetup\_setup64.tmp
- %TEMP%\is-2qodv.tmp\idp.dll
- %CommonProgramFiles(x86)%\winrar archiver\update\is-j2ktj.tmp
- %TEMP%\is-2qodv.tmp\is-7daiv.tmp
- %APPDATA%\neon\05-11-2020
Deletes the following files
- %TEMP%\is-huo1b.tmp\idp.dll
- %TEMP%\is-huo1b.tmp\_isetup\_setup64.tmp
- %TEMP%\is-slqjf.tmp\winrarx64.tmp
- %TEMP%\is-2qodv.tmp\_setup.exe
- %TEMP%\is-2qodv.tmp\idp.dll
- %TEMP%\is-2qodv.tmp\_isetup\_setup64.tmp
- %TEMP%\is-976fc.tmp\winrarx64.tmp
Moves the following files
- from %CommonProgramFiles(x86)%\winrar archiver\update\is-j2ktj.tmp to %CommonProgramFiles(x86)%\winrar archiver\update\wrarupd.exe
- from %TEMP%\is-2qodv.tmp\is-7daiv.tmp to %TEMP%\is-2qodv.tmp\_setup.exe
Network activity
Connects to
- 'qa##.##namic-dns.net':10134
TCP
HTTP GET requests
- http://ip##pi.com/json/
UDP
- DNS ASK ip##pi.com
- DNS ASK qa##.##namic-dns.net
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\vens.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' /c Add-MpPreference -ExclusionPath "%TEMP%\RarSFX0\vens.exe"
- '%TEMP%\rarsfx0\winrarx64.exe'
- '%TEMP%\is-slqjf.tmp\winrarx64.tmp' /SL5="$B01DC,3247882,122880,%TEMP%\RarSFX0\winrarx64.exe"
- '%TEMP%\rarsfx0\winrarx64.exe' /VERYSILENT
- '%TEMP%\is-976fc.tmp\winrarx64.tmp' /SL5="$70220,3247882,122880,%TEMP%\RarSFX0\winrarx64.exe" /VERYSILENT
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' /c Add-MpPreference -ExclusionPath "%TEMP%\RarSFX0\vens.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im "wrarupd.exe"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /F /SC ONLOGON /RL HIGHEST /TN "WinRAR archiver Auto Update Scheduler" /TR "\"%CommonProgramFiles(x86)%\WinRAR archiver\Update\wrarupd.exe\"' (with hidden window)
- '%TEMP%\rarsfx0\vens.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /query
- '%WINDIR%\syswow64\schtasks.exe' /create /sc MINUTE /tn notepad /MO 1 /tr %TEMP%\RarSFX0\vens.exe
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe'
- '%WINDIR%\syswow64\schtasks.exe' /Create /F /SC ONLOGON /RL HIGHEST /TN "WinRAR archiver Auto Update Scheduler" /TR "\"%CommonProgramFiles(x86)%\WinRAR archiver\Update\wrarupd.exe\"
- '<SYSTEM32>\taskeng.exe' {1A80F490-E1AB-4C9E-A2C9-77FE0D8A5896} S-1-5-21-1960123792-2022915161-3775307078-1001:ebfbsjv\user:Interactive:[1]
