Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\rundll32.exe' %PROGRAMDATA%\goBdwcB.dll,f1
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Network activity
TCP
- 'st###diato.at':443
UDP
- DNS ASK st###diato.at
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\rundll32.exe' %PROGRAMDATA%\goBdwcB.dll,f1' (with hidden window)
