Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'aebccck' = '"C:\ahfkdae\AutoIt3.exe" C:\ahfkdae\aebccck.a3x'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
Modifies file system
Creates the following files
- %TEMP%\is-j715d.tmp\<File name>.tmp
- nul
- %ALLUSERSPROFILE%\jxc5kzv.a3x
- %LOCALAPPDATA%\edition\is-d8a95.tmp
- %LOCALAPPDATA%\edition\is-h5a7p.tmp
- %LOCALAPPDATA%\edition\is-uphtv.tmp
- %TEMP%\is-b1715.tmp\is-tpkm8.tmp
- %TEMP%\is-b1715.tmp\is-lop0c.tmp
- %TEMP%\is-b1715.tmp\is-u9q9r.tmp
- %TEMP%\is-b1715.tmp\is-sog2v.tmp
- %TEMP%\is-b1715.tmp\is-nfkj2.tmp
- %TEMP%\is-b1715.tmp\is-0lg2n.tmp
- %TEMP%\is-b1715.tmp\is-qqmnn.tmp
- %TEMP%\is-b1715.tmp\is-9ef0o.tmp
- %TEMP%\is-b1715.tmp\is-c4o4q.tmp
- %TEMP%\is-b1715.tmp\is-kvlcf.tmp
- %TEMP%\is-b1715.tmp\is-ft5gl.tmp
- %TEMP%\is-b1715.tmp\is-vj7th.tmp
- %TEMP%\is-b1715.tmp\is-3rscp.tmp
- %TEMP%\is-b1715.tmp\is-mfpts.tmp
- %TEMP%\is-b1715.tmp\is-jgl7u.tmp
- %TEMP%\is-b1715.tmp\is-0fs3j.tmp
- %TEMP%\is-b1715.tmp\is-gh006.tmp
- %TEMP%\is-b1715.tmp\is-qlrr5.tmp
- %TEMP%\is-b1715.tmp\is-drn4p.tmp
- %TEMP%\is-b1715.tmp\_isetup\_setup64.tmp
- %TEMP%\is-rqoes.tmp\<File name>.tmp
- %TEMP%\is-9m7in.tmp\_isetup\_setup64.tmp
- C:\ahfkdae\aebccck.a3x
- C:\ahfkdae\autoit3.exe
Deletes the following files
- %TEMP%\is-9m7in.tmp\_isetup\_setup64.tmp
- %TEMP%\is-b1715.tmp\_isetup\_setup64.tmp
- %TEMP%\is-b1715.tmp\bfit.dll
- %TEMP%\is-b1715.tmp\bds.dll
- %TEMP%\is-b1715.tmp\bdp.dll
- %TEMP%\is-b1715.tmp\bdm.dll
- %TEMP%\is-b1715.tmp\bdis.dll
- %TEMP%\is-b1715.tmp\bdim.dll
- %TEMP%\is-b1715.tmp\bdd.dll
- %TEMP%\is-b1715.tmp\bcom.dll
- %TEMP%\is-b1715.tmp\banner.dll
- %TEMP%\is-b1715.tmp\1 (9).exe
- %TEMP%\is-b1715.tmp\1 (8).exe
- %TEMP%\is-b1715.tmp\1 (7).exe
- %TEMP%\is-b1715.tmp\1 (6).exe
- %TEMP%\is-b1715.tmp\1 (5).exe
- %TEMP%\is-b1715.tmp\1 (4).exe
- %TEMP%\is-b1715.tmp\1 (3).exe
- %TEMP%\is-b1715.tmp\1 (2).exe
- %TEMP%\is-b1715.tmp\1 (10).exe
- %TEMP%\is-b1715.tmp\1 (1).exe
- %TEMP%\is-j715d.tmp\<File name>.tmp
- %TEMP%\is-rqoes.tmp\<File name>.tmp
- %ALLUSERSPROFILE%\jxc5kzv.a3x
Moves the following files
- from %TEMP%\is-b1715.tmp\is-drn4p.tmp to %TEMP%\is-b1715.tmp\1 (1).exe
- from %LOCALAPPDATA%\edition\is-uphtv.tmp to %LOCALAPPDATA%\edition\ebalaka.exe
- from %TEMP%\is-b1715.tmp\is-tpkm8.tmp to %TEMP%\is-b1715.tmp\bfit.dll
- from %TEMP%\is-b1715.tmp\is-lop0c.tmp to %TEMP%\is-b1715.tmp\bds.dll
- from %TEMP%\is-b1715.tmp\is-u9q9r.tmp to %TEMP%\is-b1715.tmp\bdp.dll
- from %TEMP%\is-b1715.tmp\is-sog2v.tmp to %TEMP%\is-b1715.tmp\bdm.dll
- from %TEMP%\is-b1715.tmp\is-nfkj2.tmp to %TEMP%\is-b1715.tmp\bdis.dll
- from %TEMP%\is-b1715.tmp\is-0lg2n.tmp to %TEMP%\is-b1715.tmp\bdim.dll
- from %TEMP%\is-b1715.tmp\is-qqmnn.tmp to %TEMP%\is-b1715.tmp\bdd.dll
- from %TEMP%\is-b1715.tmp\is-9ef0o.tmp to %TEMP%\is-b1715.tmp\bcom.dll
- from %TEMP%\is-b1715.tmp\is-c4o4q.tmp to %TEMP%\is-b1715.tmp\banner.dll
- from %TEMP%\is-b1715.tmp\is-kvlcf.tmp to %TEMP%\is-b1715.tmp\1 (9).exe
- from %TEMP%\is-b1715.tmp\is-ft5gl.tmp to %TEMP%\is-b1715.tmp\1 (8).exe
- from %TEMP%\is-b1715.tmp\is-vj7th.tmp to %TEMP%\is-b1715.tmp\1 (7).exe
- from %TEMP%\is-b1715.tmp\is-3rscp.tmp to %TEMP%\is-b1715.tmp\1 (6).exe
- from %TEMP%\is-b1715.tmp\is-mfpts.tmp to %TEMP%\is-b1715.tmp\1 (5).exe
- from %TEMP%\is-b1715.tmp\is-jgl7u.tmp to %TEMP%\is-b1715.tmp\1 (4).exe
- from %TEMP%\is-b1715.tmp\is-0fs3j.tmp to %TEMP%\is-b1715.tmp\1 (3).exe
- from %TEMP%\is-b1715.tmp\is-gh006.tmp to %TEMP%\is-b1715.tmp\1 (2).exe
- from %TEMP%\is-b1715.tmp\is-qlrr5.tmp to %TEMP%\is-b1715.tmp\1 (10).exe
- from %LOCALAPPDATA%\edition\is-h5a7p.tmp to %LOCALAPPDATA%\edition\dissoluteness.rtf
- from %LOCALAPPDATA%\edition\is-d8a95.tmp to %LOCALAPPDATA%\edition\dissoluteness1.imp
Miscellaneous
Creates and executes the following
- '%TEMP%\is-j715d.tmp\<File name>.tmp' /SL5="$5024A,9704973,825344,<Full path to file>"
- '%TEMP%\is-rqoes.tmp\<File name>.tmp' /SL5="$1500A6,9704973,825344,<Full path to file>" /VERYSILENT
- '%LOCALAPPDATA%\edition\ebalaka.exe' "%LOCALAPPDATA%\Edition\\dissoluteness1.imp"
- '%LOCALAPPDATA%\edition\ebalaka.exe' %ALLUSERSPROFILE%\\jXc5KZV.a3x
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
- '<SYSTEM32>\find.exe' /I "nswscsvc.exe"
- '<SYSTEM32>\find.exe' /I "avgui.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
- '<SYSTEM32>\find.exe' /I "sophoshealth.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1 >nul && Ebalaka.exe %ALLUSERSPROFILE%\\jXc5KZV.a3x && del %ALLUSERSPROFILE%\\jXc5KZV.a3x
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
- '%WINDIR%\syswow64\ping.exe' -n 5 127.0.0.1
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
- '<SYSTEM32>\find.exe' /I "avastui.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
- '<SYSTEM32>\find.exe' /I "wrsa.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
- '<SYSTEM32>\find.exe' /I "opssvc.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1 >nul && Ebalaka.exe %ALLUSERSPROFILE%\\jXc5KZV.a3x && del %ALLUSERSPROFILE%\\jXc5KZV.a3x' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"' (with hidden window)
