Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\grpconv.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\remcos\logs.dat
Network activity
Connects to
- '20#.#7.107.123':8780
- 'ge###ugin.net':80
TCP
HTTP GET requests
- http://ge###ugin.net/json.gp
Other
- '20#.#7.107.123':8780
UDP
- DNS ASK ge###ugin.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\grpconv.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\grpconv.exe'
