Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 659a4a536c47d0f9
- <SYSTEM32>\tasks\nvprofileupdateron_258905059420435782678813353249588569265
- <SYSTEM32>\tasks\nvprofileupdateron_16654580357514887039735943507753171839
- <SYSTEM32>\tasks\nvprofileupdateron_109129657134050681287814441943227574792
- <SYSTEM32>\tasks\nvprofileupdateron_11998811998967302011097226908270542184
- <SYSTEM32>\tasks\nvprofileupdateron_323456718650689262373716420130322618589
- <SYSTEM32>\tasks\nvprofileupdateron_188517561668266614456761256009670121093
- <SYSTEM32>\tasks\nvprofileupdateron_173782734358699519917420689277163659376
- <SYSTEM32>\tasks\nvprofileupdateron_6227188821949756770538122555941483243
- <SYSTEM32>\tasks\nvprofileupdateronlogin_amd
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath %LOCALAPPDATA%\Temp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath C:\Users\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath %WINDIR%\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath "%ProgramFiles%\\"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath "%ProgramFiles(x86)%\\"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionExtension exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionExtension dll
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionExtension sys
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionExtension msi
Modifies file system
Creates the following files
- %APPDATA%\jardrvi
- %TEMP%\6383.exe
- %TEMP%\7899.bat
- %TEMP%\8ca7.exe
- %TEMP%\9234.exe
- %CommonProgramFiles%\dwm.exe
- %LOCALAPPDATA%\dwm.exe
- C:\users\public\dwm.exe
- %HOMEPATH%\dwm.exe
- %ProgramFiles%\dwm.exe
- %TEMP%\dwm.exe
- %ProgramFiles(x86)%\dwm.exe
- %TEMP%\sihosting.exe
- C:\users\public\disable.exe
- %TEMP%\svchoster.exe
- %APPDATA%\dwm_32.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\jardrvi
Deletes itself.
Network activity
Connects to
- 'tr####inmyus.com':80
- 'm2###.ulm.ac.id':80
- 'ma####netwotk.click':443
- 'no###lware.top':80
- '45.##4.254.172':80
- '15#.#01.28.51':8778
TCP
HTTP GET requests
- http://m2###.ulm.ac.id/osminogs.exe
- http://no###lware.top/ruster.exe
- http://45.##4.254.172/HelloWorld.exe
- http://no###lware.top/info.txt
- http://bo#.##tmalware.top/info.txt
- http://no###lware.top/min.bin
- http://no###lware.top/rust-defender-disabe.exe
- http://no###lware.top/socks32.exe
HTTP POST requests
- http://tr####inmyus.com/index.php
- http://no###lware.top/info.php
Other
- 'ma####netwotk.click':443
- '15#.#01.28.51':8778
UDP
- DNS ASK tr####inmyus.com
- DNS ASK m2###.ulm.ac.id
- DNS ASK ma####netwotk.click
- DNS ASK no###lware.top
- DNS ASK bo#.##tmalware.top
Miscellaneous
Creates and executes the following
- '%TEMP%\6383.exe'
- '%TEMP%\8ca7.exe'
- '%TEMP%\9234.exe'
- 'C:\users\public\disable.exe'
- '%TEMP%\svchoster.exe'
- '%TEMP%\sihosting.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7899.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7899.bat" "
- '<SYSTEM32>\cmd.exe' /C %TEMP%\svchoster.exe
- '<SYSTEM32>\cmd.exe' /C C:\Users\Public\disable.exe
- '<SYSTEM32>\cmd.exe' /C %TEMP%\sihosting.exe
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_16654580357514887039735943507753171839 /tr C:\\Users\\user\\dwm.exe
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_258905059420435782678813353249588569265 /tr C:\\Users\\user\\AppData\\Local\\Temp\\dwm.exe
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_188517561668266614456761256009670121093 /tr "C:\\Program Files\\dwm.exe"
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_6227188821949756770538122555941483243 /tr "C:\\Program Files (x86)\\dwm.exe"
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_109129657134050681287814441943227574792 /tr "C:\\Program Files\\dwm.exe"
- '<SYSTEM32>\cmd.exe' /C powershell -Command "Add-MpPreference -ExclusionPath %temp%"
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_173782734358699519917420689277163659376 /tr C:\\Users\\Public\\dwm.exe
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_323456718650689262373716420130322618589 /tr "C:\\Program Files\\Common Files\\dwm.exe"
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_11998811998967302011097226908270542184 /tr C:\\Users\\user\\AppData\\Local\\dwm.exe
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_6227188821949756770538122555941483243 /tr "C:\\Program Files (x86)\\dwm.exe"
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_258905059420435782678813353249588569265 /tr C:\\Users\\user\\AppData\\Local\\Temp\\dwm.exe
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_188517561668266614456761256009670121093 /tr "C:\\Program Files\\dwm.exe"
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_109129657134050681287814441943227574792 /tr "C:\\Program Files\\dwm.exe"
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_16654580357514887039735943507753171839 /tr C:\\Users\\user\\dwm.exe
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_173782734358699519917420689277163659376 /tr C:\\Users\\Public\\dwm.exe
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_11998811998967302011097226908270542184 /tr C:\\Users\\user\\AppData\\Local\\dwm.exe
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_323456718650689262373716420130322618589 /tr "C:\\Program Files\\Common Files\\dwm.exe"
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc onlogon /tn NvProfileUpdaterOnLogIN_AMD /tr C:\\Users\\user\\AppData\\Roaming\\dwm_32.exe
- '<SYSTEM32>\schtasks.exe' /create /sc onlogon /tn NvProfileUpdaterOnLogIN_AMD /tr C:\\Users\\user\\AppData\\Roaming\\dwm_32.exe
