Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "iNode Client.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "iNode Client.ex"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "iNodeMon.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "AuthenMngService.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "AuthenMngServic"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "NTChecker.exe"
Modifies file system
Creates the following files
- C:\inodelog\setup2020092000.log
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\disk1\0x0409.ini
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\disk1\0x0804.ini
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\disk1\data1.cab
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\disk1\data1.hdr
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\disk1\issetup.dll
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\disk1\layout.bin
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\disk1\setup.exe
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\disk1\setup.ini
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\disk1\setup.inx
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\setup.ini
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\setup.exe
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\0x0404.ini
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\0x0409.ini
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\0x0804.ini
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\issetup.dll
- %TEMP%\e178.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\sete1d7.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\_ise2df.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\defe2de.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\isre2af.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\stre29e.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\isbe28d.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\dote28c.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\core26b.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\dote27c.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\dife26a.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\fone269.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\eule259.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\eule258.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\eule246.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\sete1e7.tmp
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\_ise2f0.tmp
- %TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\disk1\0x0404.ini
- C:\tmp\inodesetup0\log\eadapxsvr.2020092000.log
- C:\tmp\inodesetup0\data\7000\1cfg.xml
- C:\inodelog\stp_setup2020092000.log
- C:\inodelog\stp_utlfile2020092000.log
- C:\tmp\inodesetup0\qt.7z
- C:\tmp\inodesetup0\7za.exe
- C:\tmp\inodesetup0\inodeclient.7z
- C:\tmp\inodesetup0\tool.7z
- C:\tmp\inodesetup0\qt\libglesv2.dll
- C:\tmp\inodesetup0\qt\imageformats\qgif.dll
- C:\tmp\inodesetup0\qt\imageformats\qico.dll
- C:\tmp\inodesetup0\qt\imageformats\qjpeg.dll
- C:\tmp\inodesetup0\qt\qt5core.dll
- C:\tmp\inodesetup0\qt\qt5gui.dll
- C:\tmp\inodesetup0\qt\qt5network.dll
- C:\tmp\inodesetup0\qt\qt5widgets.dll
- C:\tmp\inodesetup0\qt\qt5xml.dll
- C:\tmp\inodesetup0\qt\platforms\qwindows.dll
- C:\tmp\inodesetup0\2401-1cfg.xml
- C:\tmp\inodesetup0\data\conn_cfg.ini
- C:\tmp\inodesetup0\data\locations.xml
- C:\tmp\inodesetup0\inodesetup.exe
- C:\tmp\inodesetup0\msvcr100.dll
- C:\tmp\inodesetup0\eadapxsvr.exe
- C:\tmp\inodesetup0\msvcp100.dll
- C:\tmp\inodesetup0\installinfo.xml
- C:\tmp\inodesetup0\locations.xml
- C:\tmp\inodesetup0\inodeuninstallinfoxml.vrf
- C:\tmp\inodesetup0\inodeuninstallinfo.xml
- C:\tmp\inodesetup0\inodecustomxml.vrf
- C:\tmp\inodesetup0\inodecustom.xml
- C:\tmp\inodesetup0\conn_cfg.ini
- C:\tmp\inodesetup0\7000-1cfg.xml
- C:\tmp\inodesetup0\data\2401\1cfg.xml
- C:\inodelog\instclient9-20-2020.log
Deletes the following files
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\eula.txt
Moves the following files
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\sete1d7.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\setup.inx
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\sete1e7.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\setup00.dll
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\eule246.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\eulach.txt
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\eule258.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\eule257.tmp
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\eule259.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\eula.txt
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\fone269.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\fontdata.ini
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\dife26a.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\difxdata.ini
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\core26b.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\corecomp.ini
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\dote27c.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\dotnetinstaller.exe
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\dote28c.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\dotnetinstaller.exe.config
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\isbe28d.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\isbew64.exe
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\stre29e.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\stringtable_0x0409.ips
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\isre2af.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\isrt.dll
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\defe2de.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\default.pal
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\_ise2df.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\_isuser_0x0409.dll
- from %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\_ise2f0.tmp to %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\_isres_0x0409.dll
Substitutes the following files
- %TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\{2dbc9f17-9894-4220-9a9c-2cf7aa59e0fd}\eula.txt
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- 'C:\tmp\inodesetup0\7za.exe' x "C:\tmp\iNodeSetup0\Qt.7z" -o"C:\tmp\iNodeSetup0" -y
- '%TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9CFEB626-A7B8-4F18-91D9-A862422D2B14}
- '%TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{160511AE-F7B0-4AC8-9FAA-F499892BD964}
- '%TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B8C9504C-6BAD-4C62-AED2-B64F36FA13CA}
- '%TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C1916A69-DB50-497F-AED7-6BF792FF49D0}
- 'C:\tmp\inodesetup0\7za.exe' x "C:\tmp\iNodeSetup0\tool.7z" -o"C:\tmp\iNodeSetup0" -y
- '%TEMP%\{de063ad2-3797-4a6d-b8c8-24564251a231}\setup.exe' -package:"C:\tmp\iNodeSetup0\iNodeSetup.exe" -no_selfdeleter -IS_temp -media_path:"%TEMP%\{DE063AD2-3797-4A6D-B8C8-24564251A231}\Disk1\" -tempdisk1folder:"%TEMP%\{DE063AD2-3797-4A6D-B8C8-245642...
- '%TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BC920FAB-F6C7-472F-833D-C745A47139FA}
- '%TEMP%\{eeb44980-2e39-44c0-a828-c024c36302d3}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{07D403DB-A37E-444C-A1CD-A2CCFE26BC5D}
- 'C:\tmp\inodesetup0\eadapxsvr.exe' -exiteadclient
- 'C:\tmp\inodesetup0\eadapxsvr.exe' -setUpdInfo
- 'C:\tmp\inodesetup0\inodesetup.exe'
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "iNode Client.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "iNode Client.ex"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "iNodeMon.exe"' (with hidden window)
- 'C:\tmp\inodesetup0\eadapxsvr.exe' -exiteadclient' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "AuthenMngServic"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "NTChecker.exe"' (with hidden window)
- 'C:\tmp\inodesetup0\eadapxsvr.exe' -setUpdInfo' (with hidden window)
- 'C:\tmp\inodesetup0\7za.exe' x "C:\tmp\iNodeSetup0\tool.7z" -o"C:\tmp\iNodeSetup0" -y' (with hidden window)
- 'C:\tmp\inodesetup0\7za.exe' x "C:\tmp\iNodeSetup0\Qt.7z" -o"C:\tmp\iNodeSetup0" -y' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete INODE_SVR_SERVICE' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete INODE_SVR_MNG_SERVICE' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "AuthenMngService.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' delete INODE_SVR_SERVICE
- '%WINDIR%\syswow64\sc.exe' delete INODE_SVR_MNG_SERVICE
