Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Proccess Runtime' = '%APPDATA%\Process Runtime.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\nvngxupdatecheckdaily_{6eefbfb0-bfb0-bfb0-bfb0-6eefbfb0bfb0}
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
deletes volume shadow copies.
Injects code into
the following system processes:
- %WINDIR%\syswow64\explorer.exe
- %WINDIR%\explorer.exe
the following user processes:
- iexplore.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\d47f.tmp
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\log2ae5.tmp
- %TEMP%\103d.exe
- %TEMP%\fe2b.exe
- %TEMP%\e822.exe
- %TEMP%\e4f4.exe
- %TEMP%\85b7.tmp-shm
- %APPDATA%\process runtime.exe
- %APPDATA%\secureloc\icon64.png
- %APPDATA%\secureloc\icon16.png
- %APPDATA%\secureloc\background.js
- %APPDATA%\secureloc\manifest.json
- %APPDATA%\secureloc\p.js
- %APPDATA%\secureloc\j.js
- %TEMP%\e0bd.exe
- %APPDATA%\dhuwacv
- %APPDATA%\cuwirse
- %APPDATA%\secureloc\icon128.png
- %TEMP%\99f9.tmp-shm
Sets the 'hidden' attribute to the following files
- %APPDATA%\cuwirse
- %APPDATA%\dhuwacv
Deletes the following files
- %TEMP%\85b7.tmp-shm
- %TEMP%\99f9.tmp-shm
- %TEMP%\e822.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://px#####server17km.xyz/ald.exe
- http://px#####server17km.xyz/zel777.exe
- http://px#####server17km.xyz/mtx999.exe
- http://px#####server17km.xyz/ztx555.exe
- http://px#####server17km.xyz/lkx999.exe
HTTP POST requests
- http://re###at35.club/statweb77/
- http://pq#####erver17km.xyz/gate/cfg/?po############################
UDP
- DNS ASK re###at35.club
- DNS ASK px#####server17km.xyz
- DNS ASK pq#####erver17km.xyz
- DNS ASK ap#.#yip.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\e0bd.exe'
- '%TEMP%\e4f4.exe'
- '%APPDATA%\process runtime.exe'
- '%TEMP%\e822.exe'
- '%TEMP%\fe2b.exe'
- '%TEMP%\103d.exe'
- '%APPDATA%\process runtime.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 && del "%TEMP%\E822.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --load-extension="%APPDATA%\SecureLoc" --silent-launch
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 && del "%TEMP%\E822.exe"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1
- '%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
- '<SYSTEM32>\vssvc.exe'
