Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
- [HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,3...
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM "HD-Player.exe" /T
- '<SYSTEM32>\taskkill.exe' /F /IM "BlueStacks.exe" /T
- '<SYSTEM32>\taskkill.exe' /F /IM "HD-Agent.exe" /T
- '<SYSTEM32>\taskkill.exe' /F /IM "BstkSVC.exe" /T
- '<SYSTEM32>\taskkill.exe' /F /IM "HD-Frontend.exe" /T
- '<SYSTEM32>\taskkill.exe' /F /IM "HD-LogRotatorService.exe" /T
- '<SYSTEM32>\taskkill.exe' /F /IM "BlueStacksWebHelper.exe" /T
Modifies file system
Creates the following files
- %TEMP%\onefile_1036_134153501465612458\main.dll
- %TEMP%\onefile_1036_134153501465612458\aes.py
- %TEMP%\onefile_1036_134153501465612458\loginresnew_pb2.py
- %TEMP%\onefile_1036_134153501465612458\loginres_pb2.py
- %TEMP%\onefile_1036_134153501465612458\_asyncio.pyd
- %TEMP%\onefile_1036_134153501465612458\_brotli.pyd
- %TEMP%\onefile_1036_134153501465612458\_bz2.pyd
- %TEMP%\onefile_1036_134153501465612458\_cffi_backend.pyd
- %TEMP%\onefile_1036_134153501465612458\_ctypes.pyd
- %TEMP%\onefile_1036_134153501465612458\_decimal.pyd
- %TEMP%\onefile_1036_134153501465612458\_hashlib.pyd
- %TEMP%\onefile_1036_134153501465612458\_lzma.pyd
- %TEMP%\onefile_1036_134153501465612458\_multiprocessing.pyd
- %TEMP%\onefile_1036_134153501465612458\_overlapped.pyd
- %TEMP%\onefile_1036_134153501465612458\_queue.pyd
- %TEMP%\onefile_1036_134153501465612458\_ruamel_yaml.pyd
- %TEMP%\onefile_1036_134153501465612458\_socket.pyd
- %TEMP%\onefile_1036_134153501465612458\_ssl.pyd
- %TEMP%\onefile_1036_134153501465612458\_uuid.pyd
- %TEMP%\onefile_1036_134153501465612458\_wmi.pyd
- %TEMP%\onefile_1036_134153501465612458\c8750f0d.0
- %TEMP%\onefile_1036_134153501465612458\libcrypto-3.dll
- %TEMP%\onefile_1036_134153501465612458\libffi-8.dll
- %TEMP%\onefile_1036_134153501465612458\libssl-3.dll
- %TEMP%\onefile_1036_134153501465612458\msvcp140.dll
- %TEMP%\onefile_1036_134153501465612458\msvcp140_1.dll
- %TEMP%\onefile_1036_134153501465612458\pyexpat.pyd
- %TEMP%\onefile_1036_134153501465612458\python3.dll
- %TEMP%\onefile_1036_134153501465612458\python312.dll
- %TEMP%\onefile_1036_134153501465612458\pythoncom312.dll
- %TEMP%\onefile_1036_134153501465612458\pywintypes312.dll
- %TEMP%\onefile_1036_134153501465612458\qt5core.dll
- %TEMP%\onefile_1036_134153501465612458\qt5gui.dll
- %TEMP%\onefile_1036_134153501465612458\qt5widgets.dll
- %TEMP%\onefile_1036_134153501465612458\select.pyd
- %TEMP%\onefile_1036_134153501465612458\unicodedata.pyd
- %TEMP%\onefile_1036_134153501465612458\vcruntime140.dll
- %TEMP%\onefile_1036_134153501465612458\vcruntime140_1.dll
- %TEMP%\onefile_1036_134153501465612458\win32api.pyd
- %TEMP%\onefile_1036_134153501465612458\crypto\hash\_md4.pyd
- %TEMP%\onefile_1036_134153501465612458\crypto\hash\_sha1.pyd
- %TEMP%\onefile_1036_134153501465612458\crypto\hash\_sha224.pyd
- %TEMP%\onefile_1036_134153501465612458\crypto\hash\_sha256.pyd
- %TEMP%\onefile_1036_134153501465612458\crypto\hash\_sha384.pyd
- %TEMP%\onefile_1036_134153501465612458\crypto\hash\_sha512.pyd
- %TEMP%\onefile_1036_134153501465612458\crypto\hash\_keccak.pyd
- %TEMP%\onefile_1036_134153501465612458\pyqt5\qtcore.pyd
- %TEMP%\onefile_1036_134153501465612458\pyqt5\qtgui.pyd
- %TEMP%\onefile_1036_134153501465612458\pyqt5\qtwidgets.pyd
- %TEMP%\onefile_1036_134153501465612458\pyqt5\sip.pyd
- %TEMP%\onefile_1036_134153501465612458\aioquic\_buffer.pyd
- %TEMP%\onefile_1036_134153501465612458\aioquic\_crypto.pyd
- %TEMP%\onefile_1036_134153501465612458\bcrypt\_bcrypt.pyd
- %TEMP%\onefile_1036_134153501465612458\certifi\cacert.pem
- %TEMP%\onefile_1036_134153501465612458\charset_normalizer\md.pyd
- %TEMP%\onefile_1036_134153501465612458\charset_normalizer\md__mypyc.pyd
- %TEMP%\onefile_1036_134153501465612458\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\onefile_1036_134153501465612458\google\_upb\_message.pyd
- %TEMP%\onefile_1036_134153501465612458\markupsafe\_speedups.pyd
- %TEMP%\onefile_1036_134153501465612458\mitmproxy\c8750f0d.0
- %TEMP%\onefile_1036_134153501465612458\mitmproxy\mitmproxy-ca-cert.cer
- %TEMP%\onefile_1036_134153501465612458\mitmproxy\mitmproxy-ca-cert.p12
- %TEMP%\onefile_1036_134153501465612458\mitmproxy\mitmproxy-ca-cert.pem
- %TEMP%\onefile_1036_134153501465612458\mitmproxy\mitmproxy-ca.p12
- %TEMP%\onefile_1036_134153501465612458\mitmproxy\mitmproxy-ca.pem
- %TEMP%\onefile_1036_134153501465612458\mitmproxy\mitmproxy-dhparam.pem
- %TEMP%\onefile_1036_134153501465612458\mitmproxy_rs\mitmproxy_rs.pyd
- %TEMP%\onefile_1036_134153501465612458\platform-tools\adbwinapi.dll
- %TEMP%\onefile_1036_134153501465612458\platform-tools\adbwinusbapi.dll
- %TEMP%\onefile_1036_134153501465612458\platform-tools\notice.txt
- %TEMP%\onefile_1036_134153501465612458\platform-tools\adb.exe
- %TEMP%\onefile_1036_134153501465612458\platform-tools\libwinpthread-1.dll
- %TEMP%\onefile_1036_134153501465612458\platform-tools\mke2fs.conf
- %TEMP%\onefile_1036_134153501465612458\platform-tools\source.properties
- %TEMP%\onefile_1036_134153501465612458\pylsqpack\_binding.pyd
- %TEMP%\onefile_1036_134153501465612458\zstandard\_cffi.pyd
- %TEMP%\onefile_1036_134153501465612458\zstandard\backend_c.pyd
Network activity
Connects to
- 'localhost':49693
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "netsh int ip reset"
- '<SYSTEM32>\netsh.exe' int ip reset
- '<SYSTEM32>\cmd.exe' /c "netsh winsock reset"
- '<SYSTEM32>\netsh.exe' winsock reset
- '<SYSTEM32>\cmd.exe' /c "ipconfig /flushdns"
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '<SYSTEM32>\cmd.exe' /c "ipconfig /release"
- '<SYSTEM32>\ipconfig.exe' /release
- '<SYSTEM32>\cmd.exe' /c "ipconfig /renew"
- '<SYSTEM32>\ipconfig.exe' /renew
- '<SYSTEM32>\cmd.exe' /c "netsh interface ip delete arpcache"
- '<SYSTEM32>\netsh.exe' interface ip delete arpcache
- '<SYSTEM32>\cmd.exe' /c "netsh winhttp reset proxy"
- '<SYSTEM32>\netsh.exe' winhttp reset proxy
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "HD-Player.exe" /T"
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "BlueStacks.exe" /T"
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "HD-Agent.exe" /T"
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "BstkSVC.exe" /T"
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "HD-Frontend.exe" /T"
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "HD-LogRotatorService.exe" /T"
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "BlueStacksWebHelper.exe" /T"
- '<SYSTEM32>\cmd.exe' /c "netsh int ip reset"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "netsh winsock reset"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ipconfig /flushdns"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ipconfig /release"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ipconfig /renew"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "netsh interface ip delete arpcache"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "netsh winhttp reset proxy"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "HD-Player.exe" /T"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "BlueStacks.exe" /T"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "HD-Agent.exe" /T"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "BstkSVC.exe" /T"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "HD-Frontend.exe" /T"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "HD-LogRotatorService.exe" /T"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM "BlueStacksWebHelper.exe" /T"' (with hidden window)
