Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\windowsupdate\scheduledkill
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' stop MinerGate
- '<SYSTEM32>\taskkill.exe' /IM wmipr.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM vshub /T /F
- '<SYSTEM32>\taskkill.exe' /IM vsnhub /T /F
- '<SYSTEM32>\taskkill.exe' /IM erenhub /T /F
- '<SYSTEM32>\taskkill.exe' /IM AudioHD.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM AudioDriver.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM penapen.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM xmarin.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM lum.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM packagest.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM wutphost.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM winlg.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM pythonw.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM UsersControl.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM WindowHelperStorageHostSystemThread118466.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM WindowHelperStorageHostSystemThread100040.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM security.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM comdev.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM xmrig.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM helper.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM attrib.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM HWDeviceService64.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM CEF.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM "Windows System Driver.exe" /T /F
- '<SYSTEM32>\taskkill.exe' /IM "Windows Driver.exe" /T /F
- '<SYSTEM32>\taskkill.exe' /IM "System.exe" /T /F
- '<SYSTEM32>\taskkill.exe' /IM "COM Surrogate.exe" /T /F
- '<SYSTEM32>\taskkill.exe' /IM AMD.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM WindowHelperStorageHostSystemThread106333.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM syslog.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM nssm.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM SIVapp.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM Kyubey.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM mel.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM NSCPUCNMINER64.EXE /T /F
- '<SYSTEM32>\taskkill.exe' /IM img002.EXE /T /F
- '<SYSTEM32>\taskkill.exe' /IM monotype.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM xpon.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM DCSHelper.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM wupdate.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM CPU.exe /T /F
Modifies file system
Creates the following files
- %TEMP%\d46e.tmp\d47e.bat
- nul
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\D46E.tmp\D47E.bat <Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\D46E.tmp\D47E.bat <Full path to file>"
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\monotype\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\xpon\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\xpon\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\isminer\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\isminer\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\comdev\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\comdev\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\wmipr\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\wmipr\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\Sysfiles\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\Sysfiles\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\AudioHDriver\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\setupsk\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\taskeng.exe' {EF6D57B4-C684-4CFD-9FE8-D06686D4D5E6} S-1-5-21-1960123792-2022915161-3775307078-1001:iympkw\user:Interactive:[1]
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\kara\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\kara\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\syslog\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\syslog\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\packagest\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\packagest\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\wutphost\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\wutphost\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\GoogleSoftware\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\GoogleSoftware\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\monotype\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\AudioHDriver\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\QIPapp\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %ALLUSERSPROFILE%\DirectX11b\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\sc.exe' delete swprv
- '<SYSTEM32>\net1.exe' stop MinerGate
- '<SYSTEM32>\timeout.exe' /t 1 /nobreak
- '<SYSTEM32>\sc.exe' delete MinerGate
- '<SYSTEM32>\schtasks.exe' /Create /F /RL HIGHEST /SC MINUTE /MO 1 /tn "Microsoft\Windows\WindowsUpdate\ScheduledKill" /TR %ALLUSERSPROFILE%\AMD\1.vbs
- '<SYSTEM32>\icacls.exe' %ALLUSERSPROFILE%\Datacardservice\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %ALLUSERSPROFILE%\Datacardservice\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %ALLUSERSPROFILE%\Cefunpacked\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %ALLUSERSPROFILE%\Cefunpacked\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %ALLUSERSPROFILE%\WindowsSQL\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %ALLUSERSPROFILE%\WindowsSQL\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %ALLUSERSPROFILE%\DirectX11b\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\kyubey\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %ALLUSERSPROFILE%\Framework\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %ALLUSERSPROFILE%\Framework\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\AMD\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\AMD\ /deny system:(OI)(CI)(F
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\xmarin\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\xmarin\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\wupdate\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %LOCALAPPDATA%\wupdate\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\SIVapp\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\SIVapp\ /deny system:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\kyubey\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\QIPapp\ /deny user:(OI)(CI)(F)
- '<SYSTEM32>\icacls.exe' %APPDATA%\setupsk\ /deny system:(OI)(CI)(F)
