Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\realtek au driver
- <SYSTEM32>\tasks\wmiprvse
- <SYSTEM32>\tasks\iexplore
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\Microsoft\Libs\WR64.sys'
Creates the following services
- 'WinRing0_1_2_0' %APPDATA%\Microsoft\Libs\WR64.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\realtek driver.exe
- %TEMP%\cqagc6owqq
- %TEMP%\epemgb58gm
- %TEMP%\kfe4bh1f83
- %TEMP%\x6jpujhdpk
- %TEMP%\xi0fpo76dq
- %TEMP%\2xcb0rx1sn
- %TEMP%\kvew09menq
- %TEMP%\krk453gzkb
- %TEMP%\vei5tzkuvb
- %TEMP%\xcb7qbzkhd
- %TEMP%\prb0w3w7cy
- %TEMP%\dwghfsbufe
- %TEMP%\j4mhcse5dh
- %TEMP%\yna8gmli5m
- <Current directory>\updater.exe
- %APPDATA%\microsoft\libs\wr64.sys
- %APPDATA%\microsoft\libs\sihost64.exe
- <SYSTEM32>\wbem\wpcsprov\24dbde2999530ef5fd907494bc374d663924116c
- <SYSTEM32>\wbem\wpcsprov\wmiprvse.exe
- %ProgramFiles(x86)%\internet explorer\pdm\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- %ProgramFiles(x86)%\internet explorer\pdm\iexplore.exe
- <SYSTEM32>\wbem\wbemcons\24dbde2999530ef5fd907494bc374d663924116c
- <SYSTEM32>\wbem\wbemcons\wmiprvse.exe
- %TEMP%\realtek au driver.exe
- %TEMP%\synapse x.exe
- %TEMP%\reviewwinhostreviewsavesdll.exe
- %TEMP%\w9uuvujkkz
- %TEMP%\w17kmhcgjt
Sets the 'hidden' attribute to the following files
- %TEMP%\realtek driver.exe
- %TEMP%\reviewwinhostreviewsavesdll.exe
- %TEMP%\synapse x.exe
Deletes the following files
- %TEMP%\w9uuvujkkz
- %TEMP%\yna8gmli5m
- %TEMP%\dwghfsbufe
- %TEMP%\prb0w3w7cy
- %TEMP%\xcb7qbzkhd
- %TEMP%\vei5tzkuvb
- %TEMP%\krk453gzkb
- %TEMP%\kvew09menq
- %TEMP%\2xcb0rx1sn
- %TEMP%\xi0fpo76dq
- %TEMP%\x6jpujhdpk
- %TEMP%\kfe4bh1f83
- %TEMP%\epemgb58gm
- %TEMP%\cqagc6owqq
- %TEMP%\j4mhcse5dh
- %TEMP%\w17kmhcgjt
Network activity
Connects to
- 'pa###bin.com':443
- 'cd#.##scordapp.com':443
- '62.##9.26.20':80
- 'ip##fo.io':443
- 'po##.#ashvault.pro':80
TCP
HTTP GET requests
- http://62.##9.26.20/searcherdemo/Python/rulerecordframescript/generatorscriptgenerator/rule/programDjangobinmessage/logPref/cutbootpool/Pref/CamAuto/rulephpgenerator/system/program/lowApiBigloa...
Other
- 'pa###bin.com':443
- 'cd#.##scordapp.com':443
- 'ip##fo.io':443
- 'po##.#ashvault.pro':80
UDP
- DNS ASK pa###bin.com
- DNS ASK cd#.##scordapp.com
- DNS ASK ip##fo.io
- DNS ASK po##.#ashvault.pro
Miscellaneous
Creates and executes the following
- '%TEMP%\realtek driver.exe'
- '%TEMP%\reviewwinhostreviewsavesdll.exe'
- '%TEMP%\synapse x.exe'
- '%ProgramFiles(x86)%\internet explorer\pdm\iexplore.exe'
- '%APPDATA%\microsoft\libs\sihost64.exe'
- '%TEMP%\realtek au driver.exe'
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "Realtek AU Driver" /tr '"%TEMP%\Realtek AU Driver.exe"' & exit' (with hidden window)
- '%ProgramFiles(x86)%\internet explorer\pdm\iexplore.exe' ' (with hidden window)
- '%APPDATA%\microsoft\libs\sihost64.exe' ' (with hidden window)
- '%TEMP%\realtek au driver.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "Realtek AU Driver" /tr '"%TEMP%\Realtek AU Driver.exe"' & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn "Realtek AU Driver" /tr '"%TEMP%\Realtek AU Driver.exe"'
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'<SYSTEM32>\wbem\wbemcons\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Internet Explorer\pdm\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'<SYSTEM32>\wbem\wpcsprov\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose
- '%WINDIR%\explorer.exe' --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=41hPqivbUt9...
