Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\rugen.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Defender
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\y1803902.exe
- %TEMP%\ixp000.tmp\n2069282.exe
- %TEMP%\ixp001.tmp\k1469111.exe
- %TEMP%\ixp001.tmp\l2665547.exe
- %TEMP%\200f691d32\rugen.exe
Deletes the following files
- %TEMP%\ixp001.tmp\l2665547.exe
- %TEMP%\ixp001.tmp\k1469111.exe
- %TEMP%\ixp000.tmp\n2069282.exe
- %TEMP%\ixp000.tmp\y1803902.exe
Network activity
Connects to
- '77.#1.68.70':19073
- '77.#1.68.63':80
TCP
HTTP POST requests
- http://77.#1.68.63/doma/net/index.php
Other
- '77.#1.68.70':19073
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\y1803902.exe'
- '%TEMP%\ixp001.tmp\k1469111.exe'
- '%TEMP%\ixp001.tmp\l2665547.exe'
- '%TEMP%\ixp000.tmp\n2069282.exe'
- '%TEMP%\200f691d32\rugen.exe'
- '%TEMP%\ixp000.tmp\y1803902.exe' ' (with hidden window)
- '%TEMP%\ixp001.tmp\k1469111.exe' ' (with hidden window)
- '%TEMP%\ixp001.tmp\l2665547.exe' ' (with hidden window)
- '%TEMP%\ixp000.tmp\n2069282.exe' ' (with hidden window)
- '%TEMP%\200f691d32\rugen.exe' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "%TEMP%\200f691d32\rugen.exe" /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "rugen.exe" /P "user:N"&&CACLS "rugen.exe" /P "user:R" /E&&echo Y|CACLS "..\200f691d32" /P "user:N"&&CACLS "..\200f691d32" /P "user:R" /E&&Exit' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' %APPDATA%\006700e5a2ab05\clip64.dll, Main' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "%TEMP%\200f691d32\rugen.exe" /F
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "rugen.exe" /P "user:N"&&CACLS "rugen.exe" /P "user:R" /E&&echo Y|CACLS "..\200f691d32" /P "user:N"&&CACLS "..\200f691d32" /P "user:R" /E&&Exit
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
- '%WINDIR%\syswow64\cacls.exe' "rugen.exe" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "rugen.exe" /P "user:R" /E
- '%WINDIR%\syswow64\cacls.exe' "..\200f691d32" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "..\200f691d32" /P "user:R" /E
- '<SYSTEM32>\taskeng.exe' {B218009F-F635-4079-8E91-1FDD0F1B1086} S-1-5-21-1238866942-1249195528-555854008-1000:urcntzvnmy\user:Interactive:[1]
- '%WINDIR%\syswow64\rundll32.exe' %APPDATA%\006700e5a2ab05\clip64.dll, Main
