Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Services.exe' = '%APPDATA%\Services.exe'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\WinCFG\Libs\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %APPDATA%\WinCFG\Libs\WinRing0x64.sys
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %APPDATA%\services.exe
- %APPDATA%\wincfg\libs\winring0x64.sys
- %APPDATA%\wincfg\libs\ddb64.dll
- %APPDATA%\wincfg\libs\nvrtc-builtins64_101.dll
- %APPDATA%\wincfg\libs\nvrtc64_101_0.dll
Network activity
TCP
- 'gu##.##neroocean.stream':10128
UDP
- DNS ASK gu##.##neroocean.stream
Miscellaneous
Creates and executes the following
- '%APPDATA%\services.exe'
Executes the following
- '<SYSTEM32>\svchost.exe' --opencl --cuda --donate-level=4 -B --coin=monero --url=gulf.moneroocean.stream:10128 --user=4AA9YGzFAKPYKEcoGNp9cW763K3zVQprVWEWymRzY4n5AZPSKRnx3DY98nHbf3wkxEEWkuwzbi8sjLm6noozdeHQJtUHp26 --...
