Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 9642553fee5889d1
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- 32b8.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %APPDATA%\durvueb
- %APPDATA%\jgecffd
- %TEMP%\6e8a.exe
- %TEMP%\cd4d.exe
- %TEMP%\446.exe
- %TEMP%\278f.exe
- %TEMP%\2da8.exe
- %TEMP%\32b8.exe
- %TEMP%\3b22.exe
- %TEMP%\5d91.exe
- %TEMP%\64a3.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\durvueb
- %APPDATA%\jgecffd
Deletes itself.
Network activity
Connects to
- '45.##0.67.148':80
- '88.##8.119.112':14961
- 'microsoft.com':80
- '45.##.231.250':62568
TCP
HTTP GET requests
- http://re######istforjuly10.xyz/raccon.exe
- http://re######istforjuly10.xyz/reestr.exe
HTTP POST requests
- http://re#####listforjuly9.xyz/
- http://re######istforjuly10.xyz/
- http://88.###.119.112:14961/ via 88.##8.119.112
- http://45.##.231.250:62568/ via 45.##.231.250
Other
- 'pr#####liloc.tumblr.com':443
UDP
- DNS ASK re#####listforjuly1.xyz
- DNS ASK re#####listforjuly2.xyz
- DNS ASK re#####listforjuly3.xyz
- DNS ASK re#####listforjuly4.xyz
- DNS ASK re#####listforjuly5.xyz
- DNS ASK re#####listforjuly6.xyz
- DNS ASK re#####listforjuly7.xyz
- DNS ASK re#####listforjuly8.xyz
- DNS ASK re#####listforjuly9.xyz
- DNS ASK re######istforjuly10.xyz
- DNS ASK pr#####liloc.tumblr.com
- DNS ASK microsoft.com
- DNS ASK te##te.in
- DNS ASK ap#.ip.sb
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\6e8a.exe'
- '%APPDATA%\durvueb'
- '%TEMP%\cd4d.exe'
- '%TEMP%\446.exe'
- '%TEMP%\278f.exe'
- '%TEMP%\2da8.exe'
- '%TEMP%\32b8.exe'
- '%TEMP%\3b22.exe'
- '%TEMP%\5d91.exe'
- '%TEMP%\64a3.exe'
- '%APPDATA%\durvueb' ' (with hidden window)
- '%ProgramFiles%\windows defender\mpcmdrun.exe' -RemoveDefinitions -All -Set-Mp Preference -DisableIOAVProtection $True -DisableRealtimeMonitoring $True -Force' (with hidden window)
Executes the following
- '<SYSTEM32>\taskeng.exe' {3AB8980B-7B97-4F70-99A2-809EFF711FB3} S-1-5-21-1960123792-2022915161-3775307078-1001:cuhhelumnpab\user:Interactive:[1]
- '%ProgramFiles%\windows defender\mpcmdrun.exe' -RemoveDefinitions -All -Set-Mp Preference -DisableIOAVProtection $True -DisableRealtimeMonitoring $True -Force
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'
