Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\RBTwO75_364] 'ImagePath' = '%WINDIR%\Temp\Ri6iT7_364.sys'
- [HKLM\System\ControlSet001\Services\{818D4468-43E2-EF11-B6ED-9C09585C9808}] 'Start' = '00000000'
- [HKLM\System\ControlSet001\Services\{818D4468-43E2-EF11-B6ED-9C09585C9808}] 'ImagePath' = 'System32\{808D4468-43E2-EF11-B6ED-9C09585C9808}'
- [HKLM\System\ControlSet002\Services\{828D4468-43E2-EF11-B6ED-9C09585C9808}] 'Start' = '00000000'
- [HKLM\System\ControlSet002\Services\{828D4468-43E2-EF11-B6ED-9C09585C9808}] 'ImagePath' = 'System32\{808D4468-43E2-EF11-B6ED-9C09585C9808}'
Creates the following services
- 'RBTwO75_364' %WINDIR%\Temp\Ri6iT7_364.sys
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\net.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\net.exe
Modifies file system
Creates the following files
- %WINDIR%\temp\4zpy4oh_364.tmp
- %WINDIR%\temp\ri6it7_364.sys
- %TEMP%\q2r546.exe
Deletes the following files
- %WINDIR%\temp\ri6it7_364.sys
Network activity
Connects to
- 'localhost':49183
- 'localhost':49256
- 'localhost':49259
- 'localhost':49262
- 'localhost':49265
- 'localhost':49267
- 'localhost':49271
- 'localhost':49274
- 'localhost':49276
- 'localhost':49278
- 'localhost':49280
- 'localhost':49282
- 'localhost':49284
- 'localhost':49286
- 'localhost':49288
- 'localhost':49290
- 'localhost':49292
- 'localhost':49294
- 'localhost':49296
- 'localhost':49298
- 'localhost':49301
- 'localhost':49305
- 'localhost':49307
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- 'localhost':49252
- 'localhost':49318
- 'localhost':49250
- 'localhost':49246
- '23.##.245.178':80
- 'localhost':49186
- 'localhost':49188
- 'localhost':49190
- 'localhost':49192
- 'localhost':49197
- 'localhost':49200
- 'localhost':49204
- 'localhost':49201
- 'localhost':49210
- 'localhost':49213
- 'localhost':49215
- 'localhost':49219
- 'localhost':49221
- 'localhost':49224
- 'localhost':49228
- 'localhost':49231
- 'localhost':49233
- 'localhost':49237
- 'localhost':49239
- 'ip###ger.com':443
- 'localhost':49242
- 'localhost':49244
- 'de#######.s.kaspersky-labs.com':443
- 'localhost':49320
TCP
HTTP GET requests
- http://23.##.245.178/cvk90
- http://23.##.245.178/qa1lz
- http://23.##.245.178/vh8ax
Other
- 'localhost':49183
- 'localhost':49271
- 'localhost':49274
- 'localhost':49278
- 'localhost':49280
- 'localhost':49276
- 'localhost':49282
- 'localhost':49284
- 'localhost':49286
- 'localhost':49288
- 'localhost':49290
- 'localhost':49292
- 'localhost':49294
- 'localhost':49228
- 'localhost':49296
- 'localhost':49298
- 'localhost':49301
- 'localhost':49285
- 'localhost':49295
- 'localhost':49281
- 'localhost':49305
- 'localhost':49307
- 'localhost':49289
- 'localhost':49297
- 'localhost':49308
- 'localhost':49302
- 'localhost':49318
- 'localhost':49265
- 'localhost':49267
- 'localhost':49262
- 'localhost':49259
- 'localhost':49256
- 'localhost':49186
- 'localhost':49192
- 'localhost':49190
- 'localhost':49197
- 'localhost':49200
- 'localhost':49201
- 'localhost':49204
- 'localhost':49210
- 'localhost':49213
- 'localhost':49215
- 'localhost':49221
- 'localhost':49219
- 'localhost':49320
- 'localhost':49277
- 'localhost':49224
- 'localhost':49233
- 'localhost':49237
- 'localhost':49239
- 'localhost':49240
- 'ip###ger.com':443
- 'localhost':49242
- 'localhost':49244
- 'localhost':49246
- 'localhost':49245
- 'de#######.s.kaspersky-labs.com':443
- 'localhost':49250
- 'localhost':49252
- 'localhost':49188
- 'localhost':49231
- 'localhost':49321
UDP
- DNS ASK ip###ger.com
- DNS ASK de#######.s.kaspersky-labs.com
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Creates and executes the following
- '%TEMP%\q2r546.exe' -accepteula -adinsilent -silent -processlevel 2 -postboot
Executes the following
- '<SYSTEM32>\svchost.exe'
- '<SYSTEM32>\net.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Remove-MpPreference -ExclusionPath C:\
- '<SYSTEM32>\svchost.exe' ' (with hidden window)
- '<SYSTEM32>\net.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Remove-MpPreference -ExclusionPath C:\' (with hidden window)
