Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'RQCHGX' = '"%APPDATA%\Windata\UQMRLP.exe"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\rqchgx.lnk
- <SYSTEM32>\tasks\rqchgx.exe
Modifies file system
Creates the following files
- %TEMP%\autc72a.tmp
- %TEMP%\_mei20882\cryptography\hazmat\bindings\_openssl.cp37-win_amd64.pyd
- %TEMP%\_mei20882\cryptography\hazmat\bindings\_constant_time.cp37-win_amd64.pyd
- %TEMP%\_mei20882\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei20882\libssl-1_1.dll
- %TEMP%\_mei20882\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei20882\main1.exe.manifest
- %TEMP%\_mei20882\cryptography-2.6.1-py3.7.egg-info\wheel
- %TEMP%\_mei20882\cryptography-2.6.1-py3.7.egg-info\record
- %TEMP%\_mei20882\cryptography-2.6.1-py3.7.egg-info\metadata
- %TEMP%\_mei20882\cryptography-2.6.1-py3.7.egg-info\license.bsd
- %TEMP%\_mei20882\cryptography-2.6.1-py3.7.egg-info\license.apache
- %TEMP%\_mei20882\cryptography-2.6.1-py3.7.egg-info\license
- %TEMP%\_mei20882\cryptography-2.6.1-py3.7.egg-info\installer
- %TEMP%\_mei20882\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei20882\libcrypto-1_1.dll
- %TEMP%\_mei20882\base_library.zip
- %TEMP%\_mei20882\include\pyconfig.h
- %TEMP%\_mei20882\unicodedata.pyd
- %TEMP%\_mei20882\ucrtbase.dll
- %TEMP%\_mei20882\select.pyd
- %TEMP%\_mei20882\python37.dll
- %TEMP%\_mei20882\pyexpat.pyd
- %TEMP%\_mei20882\certifi\cacert.pem
- %TEMP%\_mei20882\markupsafe\_speedups.cp37-win_amd64.pyd
- %TEMP%\_mei20882\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei20882\_decimal.pyd
- %TEMP%\_mei20882\_ssl.pyd
- %TEMP%\_mei20882\_socket.pyd
- %TEMP%\_mei20882\_queue.pyd
- %TEMP%\_mei20882\_overlapped.pyd
- %TEMP%\_mei20882\_multiprocessing.pyd
- %TEMP%\_mei20882\_lzma.pyd
- %TEMP%\_mei20882\cryptography-2.6.1-py3.7.egg-info\top_level.txt
- %TEMP%\_mei20882\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei20882\_ctypes.pyd
- %TEMP%\_mei20882\_cffi_backend.cp37-win_amd64.pyd
- %TEMP%\_mei20882\_bz2.pyd
- %TEMP%\_mei20882\_asyncio.pyd
- %TEMP%\_mei20882\vcruntime140.dll
- %APPDATA%\windata\uqmrlp.exe
- %TEMP%\rfbzdk.exe
- %TEMP%\_mei20882\_hashlib.pyd
- %TEMP%\_mei20882\cryptography-2.6.1-py3.7.egg-info\authors.rst
- %TEMP%\_mei20882\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei20882\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei20882\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei20882\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei20882\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\rqchgx.vbs
Deletes the following files
- %TEMP%\autc72a.tmp
Miscellaneous
Creates and executes the following
- '%TEMP%\rfbzdk.exe'
- '%WINDIR%\syswow64\wscript.exe' %TEMP%\RQCHGX.vbs
- '%APPDATA%\windata\uqmrlp.exe'
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn RQCHGX.exe /tr %APPDATA%\Windata\UQMRLP.exe /sc minute /mo 1' (with hidden window)
- '%APPDATA%\windata\uqmrlp.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn RQCHGX.exe /tr %APPDATA%\Windata\UQMRLP.exe /sc minute /mo 1
- '%WINDIR%\syswow64\schtasks.exe' /create /tn RQCHGX.exe /tr %APPDATA%\Windata\UQMRLP.exe /sc minute /mo 1
- '<SYSTEM32>\taskeng.exe' {12A83061-AE6B-405B-B81E-13486A0266C5} S-1-5-21-1960123792-2022915161-3775307078-1001:rgawgfms\user:Interactive:[1]
