Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Intel(R) Platform' = '"<Full path to file>"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'Intel(R) Platform' = '"<Full path to file>"'
Creates or modifies the following files
- <SYSTEM32>\tasks\intelplatform
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -EncodedCommand dAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABJAG4AdABlAGwAJwAgAC0ARQ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -EncodedCommand JABlAGEAPQAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQ...
Modifies file system
Creates the following files
- %TEMP%\_mei30122\vcruntime140.dll
- %TEMP%\_mei30122\vcruntime140_1.dll
- %TEMP%\_mei30122\_asyncio.pyd
- %TEMP%\_mei30122\_bz2.pyd
- %TEMP%\_mei30122\_ctypes.pyd
- %TEMP%\_mei30122\_decimal.pyd
- %TEMP%\_mei30122\_hashlib.pyd
- %TEMP%\_mei30122\_lzma.pyd
- %TEMP%\_mei30122\_multiprocessing.pyd
- %TEMP%\_mei30122\_overlapped.pyd
- %TEMP%\_mei30122\_queue.pyd
- %TEMP%\_mei30122\_socket.pyd
- %TEMP%\_mei30122\_ssl.pyd
- %TEMP%\_mei30122\_uuid.pyd
- %TEMP%\_mei30122\_wmi.pyd
- %TEMP%\_mei30122\base_library.zip
- %TEMP%\_mei30122\libcrypto-3.dll
- %TEMP%\_mei30122\libffi-8.dll
- %TEMP%\_mei30122\libssl-3.dll
- %TEMP%\_mei30122\pyexpat.pyd
- %TEMP%\_mei30122\python312.dll
- %TEMP%\_mei30122\select.pyd
- %TEMP%\_mei30122\unicodedata.pyd
- %TEMP%\_mei30122\websockets-16.0.dist-info\installer
- %TEMP%\_mei30122\websockets-16.0.dist-info\metadata
- %TEMP%\_mei30122\websockets-16.0.dist-info\record
- %TEMP%\_mei30122\websockets-16.0.dist-info\wheel
- %TEMP%\_mei30122\websockets-16.0.dist-info\entry_points.txt
- %TEMP%\_mei30122\websockets-16.0.dist-info\licenses\license
- %TEMP%\_mei30122\websockets-16.0.dist-info\top_level.txt
- %TEMP%\_mei30122\websockets\speedups.cp312-win_amd64.pyd
- %APPDATA%\intelvs1\config.json
- %APPDATA%\intelvs1\intelvs1.log
- %TEMP%\av_wgqgd
Deletes following files that it created itself
- %TEMP%\av_wgqgd
Network activity
Connects to
- 'localhost':49695
- 'ap#.##sterbulk.com':443
TCP
Other
- 'localhost':49695
- 'ap#.##sterbulk.com':443
UDP
- DNS ASK ap#.##sterbulk.com
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "wmic baseboard get serialnumber"
- '<SYSTEM32>\wbem\wmic.exe' baseboard get serialnumber
- '<SYSTEM32>\schtasks.exe' /Query /TN IntelPlatform
- '<SYSTEM32>\schtasks.exe' /Create /TN IntelPlatform /TR \"<Full path to file>\" /SC ONLOGON /RL HIGHEST /F
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -EncodedCommand dAByAHkAewBTAGUAdAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0AUwB0AGEAcgB0AHUAcABUAHkAcABlACAARABpAHMAYQBiAGwAZQBkACAALQBFAEEAIABTAHQAbw...
- '<SYSTEM32>\cmd.exe' /c "wmic baseboard get serialnumber"' (with hidden window)
