Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\senpalia.lnk
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im firefox.exe
Injects code into
the following user processes:
- senpalia.exe
Modifies file system
Creates the following files
- %TEMP%\nsubd5b.tmp\system.dll
- %LOCALAPPDATA%\programs\senpalia\locales\cs.pak
- %LOCALAPPDATA%\programs\senpalia\locales\da.pak
- %LOCALAPPDATA%\programs\senpalia\locales\de.pak
- %LOCALAPPDATA%\programs\senpalia\locales\el.pak
- %LOCALAPPDATA%\programs\senpalia\locales\en-gb.pak
- %LOCALAPPDATA%\programs\senpalia\locales\en-us.pak
- %LOCALAPPDATA%\programs\senpalia\locales\es-419.pak
- %LOCALAPPDATA%\programs\senpalia\locales\et.pak
- %LOCALAPPDATA%\programs\senpalia\locales\hr.pak
- %LOCALAPPDATA%\programs\senpalia\locales\fa.pak
- %LOCALAPPDATA%\programs\senpalia\locales\fi.pak
- %LOCALAPPDATA%\programs\senpalia\locales\fil.pak
- %LOCALAPPDATA%\programs\senpalia\locales\fr.pak
- %LOCALAPPDATA%\programs\senpalia\locales\gu.pak
- %LOCALAPPDATA%\programs\senpalia\locales\he.pak
- %LOCALAPPDATA%\programs\senpalia\locales\hi.pak
- %LOCALAPPDATA%\programs\senpalia\locales\ca.pak
- %LOCALAPPDATA%\programs\senpalia\locales\es.pak
- %LOCALAPPDATA%\programs\senpalia\locales\bn.pak
- %LOCALAPPDATA%\programs\senpalia\resources.pak
- %LOCALAPPDATA%\programs\senpalia\d3dcompiler_47.dll
- %LOCALAPPDATA%\programs\senpalia\ffmpeg.dll
- %LOCALAPPDATA%\programs\senpalia\icudtl.dat
- %LOCALAPPDATA%\programs\senpalia\libegl.dll
- %LOCALAPPDATA%\programs\senpalia\libglesv2.dll
- %LOCALAPPDATA%\programs\senpalia\license.electron.txt
- %LOCALAPPDATA%\programs\senpalia\licenses.chromium.html
- %LOCALAPPDATA%\programs\senpalia\senpalia.exe
- %LOCALAPPDATA%\programs\senpalia\locales\ar.pak
- %LOCALAPPDATA%\programs\senpalia\snapshot_blob.bin
- %LOCALAPPDATA%\programs\senpalia\v8_context_snapshot.bin
- %LOCALAPPDATA%\programs\senpalia\vk_swiftshader.dll
- %LOCALAPPDATA%\programs\senpalia\vk_swiftshader_icd.json
- %LOCALAPPDATA%\programs\senpalia\vulkan-1.dll
- %LOCALAPPDATA%\programs\senpalia\locales\af.pak
- %LOCALAPPDATA%\programs\senpalia\locales\am.pak
- %LOCALAPPDATA%\programs\senpalia\locales\bg.pak
- %LOCALAPPDATA%\programs\senpalia\locales\nb.pak
- %TEMP%\7f293cf4-6e85-4f9b-9576-e7aa2f1042a6.tmp.node
- %LOCALAPPDATA%\programs\senpalia\locales\it.pak
- %LOCALAPPDATA%\programs\senpalia\locales\ta.pak
- %LOCALAPPDATA%\programs\senpalia\locales\te.pak
- %LOCALAPPDATA%\programs\senpalia\locales\th.pak
- %LOCALAPPDATA%\programs\senpalia\locales\tr.pak
- %LOCALAPPDATA%\programs\senpalia\locales\uk.pak
- %LOCALAPPDATA%\programs\senpalia\locales\ur.pak
- %LOCALAPPDATA%\programs\senpalia\locales\vi.pak
- %LOCALAPPDATA%\programs\senpalia\locales\zh-tw.pak
- %LOCALAPPDATA%\programs\senpalia\locales\id.pak
- %LOCALAPPDATA%\programs\senpalia\resources\app.asar
- %LOCALAPPDATA%\programs\senpalia\resources\elevate.exe
- %LOCALAPPDATA%\senpalia-updater\installer.exe
- %LOCALAPPDATA%\programs\senpalia\uninstall senpalia.exe
- %HOMEPATH%\desktop\senpalia.lnk
- %TEMP%\nsubd5b.tmp\winshell.dll
- %TEMP%\14553fef-e43e-4107-abd0-1c5c4ad0dd5c.tmp.node
- %LOCALAPPDATA%\programs\senpalia\locales\sw.pak
- %LOCALAPPDATA%\programs\senpalia\chrome_200_percent.pak
- %LOCALAPPDATA%\programs\senpalia\locales\sv.pak
- %LOCALAPPDATA%\programs\senpalia\locales\ms.pak
- %LOCALAPPDATA%\programs\senpalia\locales\ja.pak
- %LOCALAPPDATA%\programs\senpalia\locales\kn.pak
- %LOCALAPPDATA%\programs\senpalia\locales\ko.pak
- %LOCALAPPDATA%\programs\senpalia\locales\lt.pak
- %LOCALAPPDATA%\programs\senpalia\locales\lv.pak
- %LOCALAPPDATA%\programs\senpalia\locales\ml.pak
- %LOCALAPPDATA%\programs\senpalia\locales\mr.pak
- %LOCALAPPDATA%\programs\senpalia\locales\hu.pak
- %LOCALAPPDATA%\programs\senpalia\locales\sl.pak
- %LOCALAPPDATA%\programs\senpalia\locales\nl.pak
- %LOCALAPPDATA%\programs\senpalia\locales\pl.pak
- %LOCALAPPDATA%\programs\senpalia\locales\pt-br.pak
- %LOCALAPPDATA%\programs\senpalia\locales\pt-pt.pak
- %LOCALAPPDATA%\programs\senpalia\locales\ro.pak
- %LOCALAPPDATA%\programs\senpalia\locales\ru.pak
- %LOCALAPPDATA%\programs\senpalia\locales\sk.pak
- %LOCALAPPDATA%\programs\senpalia\locales\sr.pak
- %LOCALAPPDATA%\programs\senpalia\locales\zh-cn.pak
- %LOCALAPPDATA%\programs\senpalia\chrome_100_percent.pak
- %TEMP%\nsubd5b.tmp\7z-out\snapshot_blob.bin
- %TEMP%\nsubd5b.tmp\7z-out\locales\en-gb.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\en-us.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\es-419.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\es.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\et.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\fa.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\fi.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\fr.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\ja.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\gu.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\he.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\hi.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\hr.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\hu.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\id.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\it.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\el.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\fil.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\de.pak
- %TEMP%\nsubd5b.tmp\7z-out\icudtl.dat
- %TEMP%\nsubd5b.tmp\stdutils.dll
- %TEMP%\nsubd5b.tmp\spiderbanner.dll
- %TEMP%\nsubd5b.tmp\nsexec.dll
- %TEMP%\nsubd5b.tmp\app-32.7z
- %TEMP%\nsubd5b.tmp\nsis7z.dll
- %TEMP%\nsubd5b.tmp\7z-out\chrome_100_percent.pak
- %TEMP%\nsubd5b.tmp\7z-out\chrome_200_percent.pak
- %TEMP%\nsubd5b.tmp\7z-out\license.electron.txt
- %TEMP%\nsubd5b.tmp\7z-out\locales\cs.pak
- %TEMP%\nsubd5b.tmp\7z-out\licenses.chromium.html
- %TEMP%\nsubd5b.tmp\7z-out\locales\af.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\am.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\ar.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\bg.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\bn.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\ca.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\da.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\pt-pt.pak
- %TEMP%\nsubd5b.tmp\7z-out\vk_swiftshader.dll
- %TEMP%\nsubd5b.tmp\7z-out\locales\lt.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\uk.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\ur.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\vi.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\zh-cn.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\zh-tw.pak
- %TEMP%\nsubd5b.tmp\7z-out\resources\app.asar
- %TEMP%\nsubd5b.tmp\7z-out\resources.pak
- %TEMP%\nsubd5b.tmp\7z-out\v8_context_snapshot.bin
- %TEMP%\nsubd5b.tmp\7z-out\locales\ko.pak
- %TEMP%\nsubd5b.tmp\7z-out\vk_swiftshader_icd.json
- %TEMP%\nsubd5b.tmp\7z-out\d3dcompiler_47.dll
- %TEMP%\nsubd5b.tmp\7z-out\ffmpeg.dll
- %TEMP%\nsubd5b.tmp\7z-out\libegl.dll
- %TEMP%\nsubd5b.tmp\7z-out\libglesv2.dll
- %TEMP%\nsubd5b.tmp\7z-out\resources\elevate.exe
- %TEMP%\nsubd5b.tmp\7z-out\senpalia.exe
- %TEMP%\nsubd5b.tmp\7z-out\locales\tr.pak
- %TEMP%\nsubd5b.tmp\7z-out\vulkan-1.dll
- %TEMP%\nsubd5b.tmp\7z-out\locales\th.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\pt-br.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\lv.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\ml.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\mr.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\ms.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\nb.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\nl.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\pl.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\kn.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\ta.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\ro.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\ru.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\sk.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\sl.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\sr.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\sv.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\sw.pak
- %TEMP%\nsubd5b.tmp\7z-out\locales\te.pak
- %APPDATA%\senpalia\d0a35db3-f980-4d3a-a6d6-62ce05327514.tmp
Moves the following files
- from %APPDATA%\senpalia\d0a35db3-f980-4d3a-a6d6-62ce05327514.tmp to %APPDATA%\senpalia\local state
Modifies the following files
Network activity
Connects to
- 'dn#.google':443
- 'ip##fo.io':443
- 'il####uckygirl.com':443
TCP
Other
- 'dn#.google':443
- 'ip##fo.io':443
- 'il####uckygirl.com':443
UDP
- DNS ASK dn#.google
- DNS ASK ip##fo.io
- DNS ASK il####uckygirl.com
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\programs\senpalia\senpalia.exe'
- '%LOCALAPPDATA%\programs\senpalia\senpalia.exe' --type=gpu-process --user-data-dir="%APPDATA%\SenPalia" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAg...
- '%LOCALAPPDATA%\programs\senpalia\senpalia.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\SenPalia" --mojo-platform-channel-handle=2120 --field-trial-ha...
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq SenPalia.exe" /FO csv | <SYSTEM32>\find.exe "SenPalia.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "chcp"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "where /r . *.sqlite"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "tasklist"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "taskkill /f /im firefox.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "where /r . cookies.sqlite"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq SenPalia.exe" /FO csv | <SYSTEM32>\find.exe "SenPalia.exe"
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "taskkill /f /im firefox.exe"
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "tasklist"
- '%WINDIR%\syswow64\where.exe' /r . *.sqlite
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "where /r . *.sqlite"
- '%WINDIR%\syswow64\findstr.exe' /C:"Detected boot environment" "%WINDIR%\Panther\setupact.log"
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "where /r . cookies.sqlite"
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
- '%WINDIR%\syswow64\chcp.com'
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "chcp"
- '%WINDIR%\syswow64\find.exe' "SenPalia.exe"
- '%WINDIR%\syswow64\tasklist.exe' /FI "USERNAME eq user" /FI "IMAGENAME eq SenPalia.exe" /FO csv
- '<SYSTEM32>\compattelrunner.exe' -m:aeinv.dll -f:UpdateSoftwareInventoryW
- '%WINDIR%\syswow64\where.exe' /r . cookies.sqlite
