Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\lfxs
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%TEMP%\dcdvpgjgmwgqtofh\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %TEMP%\dcdvpgjgmwgqtofh\WinRing0x64.sys
Modifies file system
Creates the following files
- %TEMP%\1074098\85300723.exe
- %TEMP%\dcdvpgjgmwgqtofh\cudart64_80.dll
- %TEMP%\dcdvpgjgmwgqtofh\cudart32_80.dll
- %TEMP%\dcdvpgjgmwgqtofh\joq agent.exe
- %TEMP%\bfcoouchjwqprjcq\a
- <Current directory>\data.dat
- %APPDATA%\snn\xlwvrqok\kyszku.exe
- %TEMP%\1074098\squalrnet.dll
- %TEMP%\1074098\resources\montserrat-regular.ttf
- %TEMP%\1074098\resources\montserrat-bold.ttf
- %TEMP%\1074098\readwrite.dll
- %TEMP%\1074098\newtonsoft.json.dll
- %TEMP%\1074098\memoryx.dll
- %TEMP%\1074098\memorysharp.dll
- %TEMP%\1074098\materialdesignthemes.wpf.dll
- %TEMP%\1074098\materialdesigncolors.dll
- %TEMP%\1074098\hackermode_among us obf.exe
- %TEMP%\1074098\fasm.net.dll
- %TEMP%\1074098\dragablz.dll
- %TEMP%\1074098\adafcaefc\toastedmarshmellow.dll
- %TEMP%\1074098\adafcaefc\roastedmelon.dll
- %TEMP%\1074098\adafcaefc\fermentedmango.dll
- %TEMP%\dcdvpgjgmwgqtofh\joq service.exe
- %TEMP%\dcdvpgjgmwgqtofh\winring0x64.sys
Network activity
TCP
- 'pa###bin.com':443
- 'cd#.##delivr.net':443
- 'xm#####.nanopool.org':14433
UDP
- DNS ASK pa###bin.com
- DNS ASK cd#.##delivr.net
- DNS ASK xm#####.nanopool.org
Miscellaneous
Creates and executes the following
- '%TEMP%\1074098\85300723.exe'
- '%TEMP%\1074098\hackermode_among us obf.exe'
- '%APPDATA%\snn\xlwvrqok\kyszku.exe'
- '%TEMP%\dcdvpgjgmwgqtofh\joq agent.exe' --donate-level 1 -o xmr-eu1.nanopool.org:14433 -u 8AahDWVyjfUVpZMHPDz28ggYvNY11zoFTKrrM5F1LPfB1AjHoPVdR4L6PXF6iawSfwgfD7xbAwqgeCLeNTQKkCeWLhDqhp6 -k --tls --coin monero --threads=1
- '%TEMP%\1074098\85300723.exe' ' (with hidden window)
- '%TEMP%\1074098\hackermode_among us obf.exe' ' (with hidden window)
- '%APPDATA%\snn\xlwvrqok\kyszku.exe' ' (with hidden window)
- '%TEMP%\dcdvpgjgmwgqtofh\joq agent.exe' --donate-level 1 -o xmr-eu1.nanopool.org:14433 -u 8AahDWVyjfUVpZMHPDz28ggYvNY11zoFTKrrM5F1LPfB1AjHoPVdR4L6PXF6iawSfwgfD7xbAwqgeCLeNTQKkCeWLhDqhp6 -k --tls --coin monero --threads=1' (with hidden window)
Executes the following
- '<SYSTEM32>\taskeng.exe' {C629515D-0A58-48BB-86CC-E582D99C6CA6} S-1-5-21-1960123792-2022915161-3775307078-1001:nyiumgyhtasz\user:Interactive:[1]
