Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq cheatengine*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq processhacker*" /IM * /F /T
Modifies file system
Creates the following files
- nul
- %WINDIR%\temp\tar1cbf.tmp
- %WINDIR%\temp\cab1cbe.tmp
- %WINDIR%\temp\tar650.tmp
- %WINDIR%\temp\cab64f.tmp
- %WINDIR%\temp\tar5d1.tmp
- %WINDIR%\temp\cab5d0.tmp
- %WINDIR%\temp\tarefef.tmp
- %WINDIR%\temp\cabefee.tmp
- %WINDIR%\temp\taref8f.tmp
- %WINDIR%\temp\cabef8e.tmp
- %WINDIR%\temp\tard9eb.tmp
- %WINDIR%\temp\cabd9ea.tmp
- %WINDIR%\temp\tard9ab.tmp
- %WINDIR%\temp\cab60f0.tmp
- %WINDIR%\temp\cabd9aa.tmp
- %WINDIR%\temp\cabc3c7.tmp
- %WINDIR%\temp\tarc378.tmp
- %WINDIR%\temp\cabc377.tmp
- %WINDIR%\temp\tarc328.tmp
- %WINDIR%\temp\cabc318.tmp
- %WINDIR%\temp\tarc29a.tmp
- %WINDIR%\temp\cabc299.tmp
- %WINDIR%\temp\tarad34.tmp
- %WINDIR%\temp\cabad33.tmp
- %WINDIR%\temp\taracd5.tmp
- %WINDIR%\temp\cabacd4.tmp
- %WINDIR%\temp\tar9676.tmp
- %WINDIR%\temp\cab9675.tmp
- %WINDIR%\temp\tarc3c8.tmp
- %WINDIR%\temp\tar60f1.tmp
Deletes the following files
- %WINDIR%\temp\cab9675.tmp
- %WINDIR%\temp\tar1cbf.tmp
- %WINDIR%\temp\cab1cbe.tmp
- %WINDIR%\temp\tar650.tmp
- %WINDIR%\temp\cab64f.tmp
- %WINDIR%\temp\tar5d1.tmp
- %WINDIR%\temp\cab5d0.tmp
- %WINDIR%\temp\tarefef.tmp
- %WINDIR%\temp\cabefee.tmp
- %WINDIR%\temp\taref8f.tmp
- %WINDIR%\temp\cabef8e.tmp
- %WINDIR%\temp\tard9eb.tmp
- %WINDIR%\temp\cabd9ea.tmp
- %WINDIR%\temp\tard9ab.tmp
- %WINDIR%\temp\cabd9aa.tmp
- %WINDIR%\temp\tarc3c8.tmp
- %WINDIR%\temp\cabc3c7.tmp
- %WINDIR%\temp\tarc378.tmp
- %WINDIR%\temp\cabc377.tmp
- %WINDIR%\temp\tarc328.tmp
- %WINDIR%\temp\cabc318.tmp
- %WINDIR%\temp\tarc29a.tmp
- %WINDIR%\temp\cabc299.tmp
- %WINDIR%\temp\tarad34.tmp
- %WINDIR%\temp\cabad33.tmp
- %WINDIR%\temp\taracd5.tmp
- %WINDIR%\temp\cabacd4.tmp
- %WINDIR%\temp\tar9676.tmp
- %WINDIR%\temp\cab60f0.tmp
- %WINDIR%\temp\tar60f1.tmp
Network activity
Connects to
- 'localhost':49181
- 'localhost':49183
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
Other
- 'localhost':49181
- 'localhost':49183
- 'localhost':49184
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'OllyDbg'
- ClassName: '' WindowName: 'Everything'
- ClassName: '' WindowName: 'Detect It Easy v3.01'
- ClassName: '' WindowName: 'Scylla x64 v0.9.5'
- ClassName: '' WindowName: 'Scylla x86 v0.9.5'
- ClassName: '' WindowName: 'Scylla x64 v0.9.5a'
- ClassName: '' WindowName: 'Scylla x86 v0.9.5a'
- ClassName: '' WindowName: 'Scylla x64 v0.9.8'
- ClassName: '' WindowName: 'Scylla x86 v0.9.8'
- ClassName: '' WindowName: 'FiddlerCore'
- ClassName: '' WindowName: 'FiddlerCap'
- ClassName: '' WindowName: 'Fiddler Jam'
- ClassName: '' WindowName: 'HxD'
- ClassName: '' WindowName: 'Fiddler Classic'
- ClassName: '' WindowName: 'KsDumper'
- ClassName: '' WindowName: 'x64DBG'
- ClassName: '' WindowName: 'x32DBG'
- ClassName: '' WindowName: 'Process List'
- ClassName: '' WindowName: 'Cheat Engine 7.0'
- ClassName: '' WindowName: 'Cheat Engine 7.1'
- ClassName: '' WindowName: 'Cheat Engine 7.2'
- ClassName: '' WindowName: 'Cheat Engine 7.3'
- ClassName: '' WindowName: 'Cheat Engine 7.4'
- ClassName: '' WindowName: 'Cheat Engine'
- ClassName: '' WindowName: 'Memory Viewer'
- ClassName: '' WindowName: 'IDA: Quick start'
- ClassName: '' WindowName: 'Fiddler Everywhere'
- ClassName: '' WindowName: 'Snowman'
Executes the following
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Full path to file>" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "<Full path to file>" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
