Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run\] 'Rmc-MB93WB' = '"%ALLUSERSPROFILE%\Remcos\remcos.exe"'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'Rmc-MB93WB' = '"%ALLUSERSPROFILE%\Remcos\remcos.exe"'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\BWELJGSK] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\BWELJGSK] 'ImagePath' = '%ALLUSERSPROFILE%\maufzctroszs\ciswzsmhskrk.exe'
- [HKLM\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\aiahhxqankli.sys'
Creates the following services
- 'BWELJGSK' %ALLUSERSPROFILE%\maufzctroszs\ciswzsmhskrk.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\aiahhxqankli.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
- <SYSTEM32>\conhost.exe
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\host.exe
- %TEMP%\loader.exe
- %TEMP%\proxy.exe.exe
- %ALLUSERSPROFILE%\remcos\remcos.exe
- %ALLUSERSPROFILE%\maufzctroszs\ciswzsmhskrk.exe
- %ALLUSERSPROFILE%\remcos\logs.dat
- %WINDIR%\temp\aiahhxqankli.sys
- %WINDIR%\temp\uddf64f.tmp
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\remcos\remcos.exe
Deletes the following files
- %TEMP%\host.exe
- %WINDIR%\temp\uddf64f.tmp
Network activity
Connects to
- 'pr##mc.com':2404
- 'ge###ugin.net':80
- 'xm#####.nanopool.org':10300
TCP
HTTP GET requests
- http://ge###ugin.net/json.gp
Other
- 'pr##mc.com':2404
- 'xm#####.nanopool.org':10300
UDP
- DNS ASK pr##mc.com
- DNS ASK ge###ugin.net
- DNS ASK xm#####.nanopool.org
Miscellaneous
Creates and executes the following
- '%TEMP%\host.exe'
- '%TEMP%\loader.exe'
- '%TEMP%\proxy.exe.exe'
- '%ALLUSERSPROFILE%\remcos\remcos.exe'
- '%ALLUSERSPROFILE%\maufzctroszs\ciswzsmhskrk.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHkAcwB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAdwBhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
- '%TEMP%\host.exe' ' (with hidden window)
- '%TEMP%\loader.exe' ' (with hidden window)
- '%TEMP%\proxy.exe.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHkAcwB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAdwBhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
- '%WINDIR%\syswow64\cmd.exe' <SYSTEM32>\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\sc.exe' delete "BWELJGSK"
- '%WINDIR%\syswow64\svchost.exe'
- '<SYSTEM32>\sc.exe' create "BWELJGSK" binpath= "%ALLUSERSPROFILE%\maufzctroszs\ciswzsmhskrk.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "BWELJGSK"
- '%WINDIR%\syswow64\reg.exe' export "HKEY_CURRENT_USER\SOFTWARE\Kukouri\Pixel Worlds" "%TEMP%\\Account.reg" /y
- '%WINDIR%\explorer.exe'
