Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im "623a3b4d9ea66_Tue213a3fb8da.exe" /f
- '%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- 623a3b51c24f4_tue21c0f45000.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: 'OllyDBg'
Modifies file system
Creates the following files
- %TEMP%\nsr13de.tmp
- %TEMP%\is-rifq0.tmp\idp.dll
- %TEMP%\bm1c0_.cpl
- %TEMP%\is-rifq0.tmp\5(6665____.exe
- %TEMP%\is-uj7ca.tmp\_isetup\_setup64.tmp
- %TEMP%\is-uj7ca.tmp\idp.dll
- %TEMP%\is-lf0up.tmp\623a3b2f87f4a_tue21f9129ce7aa.tmp
- %TEMP%\lael8.exe
- %TEMP%\is-gf1ke.tmp\_isetup\_setup64.tmp
- %TEMP%\is-gf1ke.tmp\idp.dll
- %TEMP%\is-gf1ke.tmp\nthost.exe
- %TEMP%\0bsqwctjzthfl0wnrtfcvydpip88ow2x033v95p
- %TEMP%\fogaw0jhlj5b1kuw0rxxj6hvjwk
- %ProgramFiles(x86)%\atomtweaker\is-687jt.tmp
- %TEMP%\1pknhfu7rpxsyxol4c8sfizvb4
- %ProgramFiles(x86)%\atomtweaker\unins000.dat
- %TEMP%\js7rt8sd3rgkmxkgkz9qx
- %TEMP%\v1orp1zelzqsiwtj5p9i6jbea
- %TEMP%\ibdoe2u5kr2rulikh4mq1ww
- %TEMP%\wmgpyyil6eevln3szabbzh
- %TEMP%\njjbapkujyzyxlg6e2qemd3nooqzqzmpl
- %TEMP%\is-rifq0.tmp\_isetup\_shfoldr.dll
- %TEMP%\567ead5f-7b00-4b97-a512-29d2eccdc26e7047556.exe
- %TEMP%\is-rifq0.tmp\_isetup\_setup64.tmp
- %TEMP%\7zscc648202\623a3b51c24f4_tue21c0f45000.exe
- %TEMP%\setup_installer.exe
- %TEMP%\7zscc648202\623a3b2a8d308_tue2110bc83cb.exe
- %TEMP%\7zscc648202\623a3b2b9fa8f_tue219ff6012.exe
- %TEMP%\7zscc648202\623a3b2ca14e3_tue2152d0ce.exe
- %TEMP%\7zscc648202\623a3b2f87f4a_tue21f9129ce7aa.exe
- %TEMP%\7zscc648202\623a3b319acb3_tue2188f431.exe
- %TEMP%\7zscc648202\623a3b336405c_tue21e68d7c5.exe
- %TEMP%\7zscc648202\623a3b4d9ea66_tue213a3fb8da.exe
- %TEMP%\7zscc648202\623a3b4f23e56_tue213d9b880.exe
- %TEMP%\7zscc648202\623a3b5326ccd_tue214ef0aea6f.exe
- %TEMP%\is-2ia7e.tmp\623a3b2f87f4a_tue21f9129ce7aa.tmp
- %TEMP%\7zscc648202\623a3b541fb42_tue2168e362a.exe
- %TEMP%\7zscc648202\623a3b547fdbe_tue21129e9eb79.exe
- %TEMP%\7zscc648202\623a3b5617676_tue2151f23d640.exe
- %TEMP%\7zscc648202\libcurl.dll
- %TEMP%\7zscc648202\libcurlpp.dll
- %TEMP%\7zscc648202\libgcc_s_dw2-1.dll
- %TEMP%\7zscc648202\libstdc++-6.dll
- %TEMP%\7zscc648202\libwinpthread-1.dll
- %TEMP%\7zscc648202\setup_install.exe
- %TEMP%\is-su3oa.tmp\623a3b5326ccd_tue214ef0aea6f.tmp
- %LOCALAPPDATA%\putty.rnd
Deletes the following files
- %TEMP%\7zscc648202\623a3b2a8d308_tue2110bc83cb.exe
- %TEMP%\is-lf0up.tmp\623a3b2f87f4a_tue21f9129ce7aa.tmp
- %TEMP%\is-gf1ke.tmp\_isetup\_setup64.tmp
- %TEMP%\is-gf1ke.tmp\nthost.exe
- %TEMP%\is-gf1ke.tmp\idp.dll
- %TEMP%\0bsqwctjzthfl0wnrtfcvydpip88ow2x033v95p
- %TEMP%\njjbapkujyzyxlg6e2qemd3nooqzqzmpl
- %TEMP%\wmgpyyil6eevln3szabbzh
- %TEMP%\7zscc648202\623a3b319acb3_tue2188f431.exe
- %TEMP%\ibdoe2u5kr2rulikh4mq1ww
- %TEMP%\js7rt8sd3rgkmxkgkz9qx
- %TEMP%\1pknhfu7rpxsyxol4c8sfizvb4
- %TEMP%\fogaw0jhlj5b1kuw0rxxj6hvjwk
- %TEMP%\7zscc648202\623a3b4d9ea66_tue213a3fb8da.exe
- %TEMP%\is-2ia7e.tmp\623a3b2f87f4a_tue21f9129ce7aa.tmp
- %TEMP%\is-uj7ca.tmp\_isetup\_setup64.tmp
- %TEMP%\is-uj7ca.tmp\idp.dll
- %TEMP%\v1orp1zelzqsiwtj5p9i6jbea
- %TEMP%\7zscc648202\623a3b51c24f4_tue21c0f45000.exe
Moves the following files
- from %ProgramFiles(x86)%\atomtweaker\is-687jt.tmp to %ProgramFiles(x86)%\atomtweaker\unins000.exe
Network activity
Connects to
- 'oo########ghts.s3.pl-waw.scw.cloud':80
- 'ic##eps.com':443
- 'ap###bstat.biz':80
- 'bl####k1.beget.tech':80
- 'zo#####taneja.com.br':80
- 'v.###gamev.com':443
- 'ge##ek.com':80
- 'ip##pi.com':80
- 'ge###un-24.com':80
- 'co###ctini.net':443
- '0.#.0.77':22
TCP
HTTP GET requests
- http://oo########ghts.s3.pl-waw.scw.cloud/sublime-publish/poweroff.exe
- http://ap###bstat.biz/stats/1.php?pu#######################
- http://ap###bstat.biz/info.php?pu########
- http://ip##pi.com/json/
- http://ge##ek.com/77.exe
HTTP POST requests
- http://ge###un-24.com/?na#######
Other
- 'ic##eps.com':443
- 'bl####k1.beget.tech':80
- 'zo#####taneja.com.br':80
- 'v.###gamev.com':443
- 'co###ctini.net':443
UDP
- DNS ASK oo########ghts.s3.pl-waw.scw.cloud
- DNS ASK ap###bstat.biz
- DNS ASK ic##eps.com
- DNS ASK bl####k1.beget.tech
- DNS ASK zo#####taneja.com.br
- DNS ASK v.###gamev.com
- DNS ASK ge##ek.com
- DNS ASK ip##pi.com
- DNS ASK ge###un-24.com
- DNS ASK co###ctini.net
Miscellaneous
Searches for the following windows
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'ID' WindowName: ''
- ClassName: 'ObsidianGUI' WindowName: ''
- ClassName: 'WinDbgFrameClass' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\setup_installer.exe'
- '%TEMP%\7zscc648202\623a3b541fb42_tue2168e362a.exe'
- '%TEMP%\567ead5f-7b00-4b97-a512-29d2eccdc26e7047556.exe'
- '%TEMP%\is-lf0up.tmp\623a3b2f87f4a_tue21f9129ce7aa.tmp' /SL5="$10294,870458,780800,%TEMP%\7zSCC648202\623a3b2f87f4a_Tue21f9129ce7aa.exe" /SILENT
- '%TEMP%\7zscc648202\623a3b2ca14e3_tue2152d0ce.exe' -h
- '%TEMP%\is-rifq0.tmp\5(6665____.exe' /S /UID=1405
- '%TEMP%\7zscc648202\623a3b2f87f4a_tue21f9129ce7aa.exe' /SILENT
- '%TEMP%\is-su3oa.tmp\623a3b5326ccd_tue214ef0aea6f.tmp' /SL5="$160220,140006,56320,%TEMP%\7zSCC648202\623a3b5326ccd_Tue214ef0aea6f.exe"
- '%TEMP%\7zscc648202\623a3b319acb3_tue2188f431.exe'
- '%TEMP%\is-2ia7e.tmp\623a3b2f87f4a_tue21f9129ce7aa.tmp' /SL5="$B0218,870458,780800,%TEMP%\7zSCC648202\623a3b2f87f4a_Tue21f9129ce7aa.exe"
- '%TEMP%\7zscc648202\623a3b336405c_tue21e68d7c5.exe'
- '%TEMP%\is-gf1ke.tmp\nthost.exe' 77
- '%TEMP%\7zscc648202\623a3b5326ccd_tue214ef0aea6f.exe'
- '%TEMP%\7zscc648202\623a3b547fdbe_tue21129e9eb79.exe'
- '%TEMP%\7zscc648202\623a3b2b9fa8f_tue219ff6012.exe'
- '%TEMP%\7zscc648202\623a3b4f23e56_tue213d9b880.exe'
- '%TEMP%\7zscc648202\623a3b2ca14e3_tue2152d0ce.exe'
- '%TEMP%\7zscc648202\623a3b2f87f4a_tue21f9129ce7aa.exe'
- '%TEMP%\7zscc648202\623a3b4d9ea66_tue213a3fb8da.exe' /mixtwo
- '%TEMP%\7zscc648202\setup_install.exe'
- '%TEMP%\7zscc648202\623a3b51c24f4_tue21c0f45000.exe'
- '%TEMP%\7zscc648202\623a3b5617676_tue2151f23d640.exe'
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "623a3b4d9ea66_Tue213a3fb8da.exe" /f & erase "%TEMP%\7zSCC648202\623a3b4d9ea66_Tue213a3fb8da.exe" & exit' (with hidden window)
- '%TEMP%\567ead5f-7b00-4b97-a512-29d2eccdc26e7047556.exe' ' (with hidden window)
- '%TEMP%\is-rifq0.tmp\5(6665____.exe' /S /UID=1405' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
- '%WINDIR%\syswow64\control.exe' "%TEMP%\bm1c0_.CpL",
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "623a3b4d9ea66_Tue213a3fb8da.exe" /f & erase "%TEMP%\7zSCC648202\623a3b4d9ea66_Tue213a3fb8da.exe" & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
- '%WINDIR%\syswow64\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
- '%WINDIR%\syswow64\cmd.exe' /c 623a3b547fdbe_Tue21129e9eb79.exe
- '%WINDIR%\syswow64\cmd.exe' /c 623a3b5326ccd_Tue214ef0aea6f.exe
- '%WINDIR%\syswow64\cmd.exe' /c 623a3b4f23e56_Tue213d9b880.exe
- '%WINDIR%\syswow64\rundll32.exe' Shell32.dll,Control_RunDLL "%TEMP%\bm1c0_.CpL",
- '%WINDIR%\syswow64\cmd.exe' /c 623a3b5617676_Tue2151f23d640.exe
- '%WINDIR%\syswow64\cmd.exe' /c 623a3b336405c_Tue21e68d7c5.exe
- '%WINDIR%\syswow64\cmd.exe' /c 623a3b2f87f4a_Tue21f9129ce7aa.exe
- '%WINDIR%\syswow64\cmd.exe' /c 623a3b51c24f4_Tue21c0f45000.exe
- '%WINDIR%\syswow64\cmd.exe' /c 623a3b4d9ea66_Tue213a3fb8da.exe /mixtwo
- '%WINDIR%\syswow64\cmd.exe' /c 623a3b2b9fa8f_Tue219ff6012.exe
- '%WINDIR%\syswow64\cmd.exe' /c 623a3b319acb3_Tue2188f431.exe
- '%WINDIR%\syswow64\cmd.exe' /c 623a3b2ca14e3_Tue2152d0ce.exe
- '%WINDIR%\syswow64\cmd.exe' /c 623a3b2a8d308_Tue2110bc83cb.exe
- '%WINDIR%\syswow64\cmd.exe' /c 623a3b541fb42_Tue2168e362a.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe
