Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Windowse0j882' = '%APPDATA%\.rrqgg28i\odqntb6c90.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,%APPDATA%\.rrqgg28i\odqntb6c90.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\windowse0j882_logon
- <SYSTEM32>\tasks\windowse0j882_check
- %APPDATA%\microsoft\windows\start menu\programs\startup\windowse0j882.lnk
- <SYSTEM32>\tasks\microsoftedgeupdatetaskmachineua136.6.7636.24{18633e03_be11_42d5_96a7_de82843a07f3}
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Windowse0j882] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Windowse0j882] 'ImagePath' = '%APPDATA%\.rrqgg28i\odqntb6c90.exe'
Creates the following services
- 'Windowse0j882' %APPDATA%\.rrqgg28i\odqntb6c90.exe
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\tracerpt.exe
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\8yr4b02umsiu\output_86_2026.04.10_18.04.08_setup.exe
- %APPDATA%\.rrqgg28i\odqntb6c90.exe
- nul
- %WINDIR%\temp\is-sez19sf7tn.tmp\odqntb6c90.tmp
- %WINDIR%\temp\is-1qwrjn2796.tmp\_isetup\_setup64.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_idx.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_16.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_32.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_48.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_96.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_256.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_768.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_1280.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_1920.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_2560.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_sr.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_wide.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_exif.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_wide_alternate.db
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\explorer\iconcache_custom_stream.db
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\is-lpgwtnw3pa.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\is-cl79n86lbb.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\is-4yjm1v071v.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\is-d5dzrowmjg.tmp
- %WINDIR%\temp\is-1qwrjn2796.tmp\is-q2np7yn17s.tmp
- %WINDIR%\temp\is-1qwrjn2796.tmp\is-02cihapc5l.tmp
- %WINDIR%\temp\is-1qwrjn2796.tmp\is-n0y61u6hx5.tmp
- %WINDIR%\temp\is-1qwrjn2796.tmp\is-i27qdsylc0.tmp
- %WINDIR%\temp\is-1qwrjn2796.tmp\is-1actdzj74o.tmp
- %WINDIR%\temp\is-1qwrjn2796.tmp\is-kdnxyp9q1r.tmp
- %WINDIR%\temp\is-1qwrjn2796.tmp\is-leqdra4g3x.tmp
- %WINDIR%\temp\is-1qwrjn2796.tmp\is-8z7pvnmlur.tmp
- %WINDIR%\temp\is-1qwrjn2796.tmp\is-9ai0bu49pa.tmp
- %WINDIR%\temp\is-1qwrjn2796.tmp\is-yjj8zunrug.tmp
- %TEMP%\my1p61ja.vbs
- %TEMP%\8yr4b02umsiu\福特 .pptx
- %TEMP%\is-z9s7ir2tuv.tmp\output_86_2026.04.10_18.04.08_setup.tmp
- %TEMP%\is-4k1g0ab1tn.tmp\_isetup\_setup64.tmp
- %APPDATA%\greencobalt\is-rcv9zowrei.tmp
- %APPDATA%\greencobalt\is-ibsjy60xp8.tmp
- %APPDATA%\greencobalt\is-s6b3gus75g.tmp
- %APPDATA%\greencobalt\is-047ba5hj1a.tmp
- %TEMP%\is-4k1g0ab1tn.tmp\is-qit1y5snf3.tmp
- %TEMP%\is-4k1g0ab1tn.tmp\is-o83fp81enh.tmp
- %TEMP%\is-4k1g0ab1tn.tmp\is-i9smgu8id6.tmp
- %TEMP%\is-4k1g0ab1tn.tmp\is-nxnlsddgax.tmp
- %TEMP%\is-4k1g0ab1tn.tmp\is-acg42mkdb2.tmp
- %TEMP%\is-4k1g0ab1tn.tmp\is-vka5tkook4.tmp
- %TEMP%\is-4k1g0ab1tn.tmp\is-lmhz39mnno.tmp
- %TEMP%\is-4k1g0ab1tn.tmp\is-591b6amffi.tmp
- %TEMP%\is-4k1g0ab1tn.tmp\is-bmmedifxhv.tmp
- %TEMP%\is-4k1g0ab1tn.tmp\is-3meksk9kb4.tmp
- %HOMEPATH%\7c9f2e84.dat
- %TEMP%\8yr4b02umsiu\~$福特 .pptx
- %ALLUSERSPROFILE%\displaysessioncontainers.log
- %TEMP%\is-lwho0501pw.tmp\odqntb6c90.tmp
- %TEMP%\is-sbs5lljkbm.tmp\_isetup\_setup64.tmp
- %APPDATA%\greencobalt\is-hl50pbgpd5.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\.rrqgg28i\odqntb6c90.exe
Deletes following files that it created itself
- %WINDIR%\temp\is-1qwrjn2796.tmp\ycylm2uw6p.lgi
- %WINDIR%\temp\is-1qwrjn2796.tmp\8aibbloy18.byv
- %WINDIR%\temp\is-1qwrjn2796.tmp\bbvdntgo3z.cri
- %WINDIR%\temp\is-1qwrjn2796.tmp\6ssserra67.xcd
- %WINDIR%\temp\is-1qwrjn2796.tmp\i0b0ubenyc.pfc
- %WINDIR%\temp\is-1qwrjn2796.tmp\3zrmqrb44s.mbd
- %WINDIR%\temp\is-1qwrjn2796.tmp\jswxlsv756.aek
- %WINDIR%\temp\is-1qwrjn2796.tmp\n5qkqf5os6.fey
- %WINDIR%\temp\is-1qwrjn2796.tmp\360base64.dll
- %WINDIR%\temp\is-1qwrjn2796.tmp\360base.dll
- %WINDIR%\temp\is-1qwrjn2796.tmp\_isetup\_setup64.tmp
- %WINDIR%\temp\is-sez19sf7tn.tmp\odqntb6c90.tmp
- %TEMP%\my1p61ja.vbs
- %TEMP%\is-4k1g0ab1tn.tmp\ycylm2uw6p.lgi
- %TEMP%\is-4k1g0ab1tn.tmp\8aibbloy18.byv
- %TEMP%\is-4k1g0ab1tn.tmp\bbvdntgo3z.cri
- %TEMP%\is-4k1g0ab1tn.tmp\6ssserra67.xcd
- %TEMP%\is-4k1g0ab1tn.tmp\i0b0ubenyc.pfc
- %TEMP%\is-4k1g0ab1tn.tmp\3zrmqrb44s.mbd
- %TEMP%\is-4k1g0ab1tn.tmp\jswxlsv756.aek
- %TEMP%\is-4k1g0ab1tn.tmp\n5qkqf5os6.fey
- %TEMP%\is-4k1g0ab1tn.tmp\360base64.dll
- %TEMP%\is-4k1g0ab1tn.tmp\360base.dll
- %TEMP%\is-4k1g0ab1tn.tmp\_isetup\_setup64.tmp
- %TEMP%\is-z9s7ir2tuv.tmp\output_86_2026.04.10_18.04.08_setup.tmp
- %APPDATA%\greencobalt\appwiz.cpl
- %APPDATA%\greencobalt\is-hl50pbgpd5.tmp
Moves the following files
- from %WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\is-lpgwtnw3pa.tmp to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\appwiz.cpl
- from %WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\is-cl79n86lbb.tmp to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\fondue.exe
- from %WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\is-4yjm1v071v.tmp to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\jdvndqvoydutq.nxptqq
- from %WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\is-d5dzrowmjg.tmp to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\vulkan-1.dll
- from %WINDIR%\temp\is-1qwrjn2796.tmp\is-q2np7yn17s.tmp to %WINDIR%\temp\is-1qwrjn2796.tmp\ycylm2uw6p.lgi
- from %WINDIR%\temp\is-1qwrjn2796.tmp\is-02cihapc5l.tmp to %WINDIR%\temp\is-1qwrjn2796.tmp\8aibbloy18.byv
- from %WINDIR%\temp\is-1qwrjn2796.tmp\is-n0y61u6hx5.tmp to %WINDIR%\temp\is-1qwrjn2796.tmp\bbvdntgo3z.cri
- from %WINDIR%\temp\is-1qwrjn2796.tmp\is-i27qdsylc0.tmp to %WINDIR%\temp\is-1qwrjn2796.tmp\6ssserra67.xcd
- from %WINDIR%\temp\is-1qwrjn2796.tmp\is-1actdzj74o.tmp to %WINDIR%\temp\is-1qwrjn2796.tmp\i0b0ubenyc.pfc
- from %WINDIR%\temp\is-1qwrjn2796.tmp\is-kdnxyp9q1r.tmp to %WINDIR%\temp\is-1qwrjn2796.tmp\3zrmqrb44s.mbd
- from %WINDIR%\temp\is-1qwrjn2796.tmp\is-leqdra4g3x.tmp to %WINDIR%\temp\is-1qwrjn2796.tmp\jswxlsv756.aek
- from %WINDIR%\temp\is-1qwrjn2796.tmp\is-8z7pvnmlur.tmp to %WINDIR%\temp\is-1qwrjn2796.tmp\n5qkqf5os6.fey
- from %WINDIR%\temp\is-1qwrjn2796.tmp\is-9ai0bu49pa.tmp to %WINDIR%\temp\is-1qwrjn2796.tmp\360base64.dll
- from %WINDIR%\temp\is-1qwrjn2796.tmp\is-yjj8zunrug.tmp to %WINDIR%\temp\is-1qwrjn2796.tmp\360base.dll
- from %APPDATA%\greencobalt\is-rcv9zowrei.tmp to %APPDATA%\greencobalt\appwiz.cpl
- from %APPDATA%\greencobalt\is-ibsjy60xp8.tmp to %APPDATA%\greencobalt\fondue.exe
- from %APPDATA%\greencobalt\is-s6b3gus75g.tmp to %APPDATA%\greencobalt\jdvndqvoydutq.nxptqq
- from %APPDATA%\greencobalt\is-047ba5hj1a.tmp to %APPDATA%\greencobalt\vulkan-1.dll
- from %TEMP%\is-4k1g0ab1tn.tmp\is-qit1y5snf3.tmp to %TEMP%\is-4k1g0ab1tn.tmp\ycylm2uw6p.lgi
- from %TEMP%\is-4k1g0ab1tn.tmp\is-o83fp81enh.tmp to %TEMP%\is-4k1g0ab1tn.tmp\8aibbloy18.byv
- from %TEMP%\is-4k1g0ab1tn.tmp\is-i9smgu8id6.tmp to %TEMP%\is-4k1g0ab1tn.tmp\bbvdntgo3z.cri
- from %TEMP%\is-4k1g0ab1tn.tmp\is-nxnlsddgax.tmp to %TEMP%\is-4k1g0ab1tn.tmp\6ssserra67.xcd
- from %TEMP%\is-4k1g0ab1tn.tmp\is-acg42mkdb2.tmp to %TEMP%\is-4k1g0ab1tn.tmp\i0b0ubenyc.pfc
- from %TEMP%\is-4k1g0ab1tn.tmp\is-vka5tkook4.tmp to %TEMP%\is-4k1g0ab1tn.tmp\3zrmqrb44s.mbd
- from %TEMP%\is-4k1g0ab1tn.tmp\is-lmhz39mnno.tmp to %TEMP%\is-4k1g0ab1tn.tmp\jswxlsv756.aek
- from %TEMP%\is-4k1g0ab1tn.tmp\is-591b6amffi.tmp to %TEMP%\is-4k1g0ab1tn.tmp\n5qkqf5os6.fey
- from %TEMP%\is-4k1g0ab1tn.tmp\is-bmmedifxhv.tmp to %TEMP%\is-4k1g0ab1tn.tmp\360base64.dll
- from %TEMP%\is-4k1g0ab1tn.tmp\is-3meksk9kb4.tmp to %TEMP%\is-4k1g0ab1tn.tmp\360base.dll
Network activity
Connects to
- '19#.#29.116.233':443
- 'localhost':80
TCP
Other
- '19#.#29.116.233':443
Miscellaneous
Creates and executes the following
- '%APPDATA%\.rrqgg28i\odqntb6c90.exe'
- '%WINDIR%\temp\is-sez19sf7tn.tmp\odqntb6c90.tmp' /SL5="$150026,8107679,836096,%APPDATA%\.rrqgg28i\odqntb6c90.exe"
- '%WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\fondue.exe' /DoScan
- '<SYSTEM32>\cscript.exe' //nologo %TEMP%\my1p61ja.vbs
- '%TEMP%\8yr4b02umsiu\output_86_2026.04.10_18.04.08_setup.exe'
- '%TEMP%\is-z9s7ir2tuv.tmp\output_86_2026.04.10_18.04.08_setup.tmp' /SL5="$801C2,8107679,836096,%TEMP%\8yr4b02umsiu\output_86_2026.04.10_18.04.08_SETUP.exe"
- '%APPDATA%\greencobalt\fondue.exe' /DoScan
- '%TEMP%\is-lwho0501pw.tmp\odqntb6c90.tmp' /SL5="$302C0,8107679,836096,%APPDATA%\.rrqgg28i\odqntb6c90.exe"
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn Windowse0j882_Logon /tr %APPDATA%\.rrqgg28i\odqntb6c90.exe /sc ONLOGON /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn Windowse0j882_Check /tr %APPDATA%\.rrqgg28i\odqntb6c90.exe /sc MINUTE /mo 1 /f
- '<SYSTEM32>\sc.exe' create Windowse0j882 binPath= %APPDATA%\.rrqgg28i\odqntb6c90.exe start= auto
- '<SYSTEM32>\sc.exe' start Windowse0j882
- '<SYSTEM32>\cmd.exe' /c start "" "%TEMP%\8yr4b02umsiu\福特 .pptx"
- '%ProgramFiles(x86)%\microsoft office\office16\powerpnt.exe' "%TEMP%\8yr4b02umsiu\福特 .pptx" /ou ""
- '%WINDIR%\syswow64\regsvr32.exe' /u %APPDATA%\GreenCobalt\APPWIZ.CPL /safeinit
- '%WINDIR%\syswow64\tracerpt.exe'
- '%WINDIR%\syswow64\svchost.exe'
- '<SYSTEM32>\schtasks.exe' /create /tn Windowse0j882_Logon /tr %APPDATA%\.rrqgg28i\odqntb6c90.exe /sc ONLOGON /rl HIGHEST /f' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn Windowse0j882_Check /tr %APPDATA%\.rrqgg28i\odqntb6c90.exe /sc MINUTE /mo 1 /f' (with hidden window)
- '<SYSTEM32>\sc.exe' create Windowse0j882 binPath= %APPDATA%\.rrqgg28i\odqntb6c90.exe start= auto' (with hidden window)
- '<SYSTEM32>\sc.exe' start Windowse0j882' (with hidden window)
- '%WINDIR%\syswow64\config\systemprofile\appdata\roaming\greencobalt\fondue.exe' /DoScan' (with hidden window)
- '<SYSTEM32>\cscript.exe' //nologo %TEMP%\my1p61ja.vbs' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c start "" "%TEMP%\8yr4b02umsiu\福特 .pptx"' (with hidden window)
- '%APPDATA%\greencobalt\fondue.exe' /DoScan' (with hidden window)
- '%WINDIR%\syswow64\tracerpt.exe' ' (with hidden window)
- '%WINDIR%\syswow64\svchost.exe' ' (with hidden window)
