Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im WindowsServiceHost.exe
- '<SYSTEM32>\taskkill.exe' /f /im RMM.Agent.Console.exe
- '<SYSTEM32>\taskkill.exe' /f /im "WindowsServiceHost.exe"
- '<SYSTEM32>\taskkill.exe' /f /im svcguard.exe
Modifies file system
Creates the following files
- <Current directory>\windowsservicehost.exe
- %TEMP%\rmm_agent_crash.log
- <Current directory>\.installed
- %TEMP%\rmm_update_3202af4472e1411896cdf69001c7230a.zip
- %TEMP%\rmm_update_7f4d5651dc2046f5815ce6099b9d2b88\windowsservicehost.exe
- %TEMP%\rmm_update_7f4d5651dc2046f5815ce6099b9d2b88\rmm.agent.console.exe
- %TEMP%\rmm_update_7f4d5651dc2046f5815ce6099b9d2b88\appsettings.json
- %TEMP%\rmm_update_7f4d5651dc2046f5815ce6099b9d2b88\vcruntime140.dll
- <Current directory>\.updating
- %TEMP%\7b9f98ed59654f119d000cca46e7fa35.ps1
- %TEMP%\rmm_update_d2b1c9ce7de84509b09bc549fd0707ee.bat
- nul
- <Current directory>.rollback\.installed
- <Current directory>.rollback\.updating
- <Current directory>.rollback\windowsservicehost.exe
- <Current directory>.rollback\<File name>.exe
- <Current directory>\appsettings.json
- <Current directory>\rmm.agent.console.exe
- <Current directory>\vcruntime140.dll
- %TEMP%\rmm_update_53ba8947e771416f9319f17ebb833091.zip
- %TEMP%\rmm_update_226815c1c99d4428a679b68c5177e0c6\windowsservicehost.exe
- %TEMP%\rmm_update_226815c1c99d4428a679b68c5177e0c6\rmm.agent.console.exe
- %TEMP%\rmm_update_226815c1c99d4428a679b68c5177e0c6\appsettings.json
- %TEMP%\rmm_update_226815c1c99d4428a679b68c5177e0c6\vcruntime140.dll
- %TEMP%\b8e8995b50e34b3c8be408f3d5c96db0.ps1
- %TEMP%\rmm_update_463e24c35fa746c7b6f6c5cf2659330d.bat
- <Current directory>.rollback\appsettings.json
- <Current directory>.rollback\rmm.agent.console.exe
- <Current directory>.rollback\vcruntime140.dll
- %TEMP%\rmm_update_4c8ccb2f10334bdfb5d668667efad8c7.zip
- %TEMP%\rmm_update_d7f443f6e1e84452a31165f25bda1f98\windowsservicehost.exe
- %TEMP%\rmm_update_d7f443f6e1e84452a31165f25bda1f98\rmm.agent.console.exe
- %TEMP%\rmm_update_d7f443f6e1e84452a31165f25bda1f98\appsettings.json
- %TEMP%\rmm_update_d7f443f6e1e84452a31165f25bda1f98\vcruntime140.dll
- %TEMP%\b00d256644b840a6a78dfa8bbad706c0.ps1
- %TEMP%\rmm_update_fc38ece863f848ee82ecb4407bfa2371.bat
- %TEMP%\rmm_update_5948cf22b7804bf386f8460c014e1515.zip
- %TEMP%\rmm_update_9ce01feb2c4d44348036c442a092607b\windowsservicehost.exe
- %TEMP%\rmm_update_9ce01feb2c4d44348036c442a092607b\rmm.agent.console.exe
- %TEMP%\rmm_update_9ce01feb2c4d44348036c442a092607b\appsettings.json
- %TEMP%\rmm_update_9ce01feb2c4d44348036c442a092607b\vcruntime140.dll
- %TEMP%\6747c23b11ff4f34bc60135f910f5bc9.ps1
- %TEMP%\rmm_update_31f8e17c32d94a03b1873b695fabc011.bat
- %TEMP%\rmm_update_05ef0d61ff684bfe985716ded5603bb4.zip
Deletes following files that it created itself
- %TEMP%\7b9f98ed59654f119d000cca46e7fa35.ps1
- %TEMP%\b8e8995b50e34b3c8be408f3d5c96db0.ps1
- %TEMP%\b00d256644b840a6a78dfa8bbad706c0.ps1
- %TEMP%\6747c23b11ff4f34bc60135f910f5bc9.ps1
Network activity
Connects to
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'st####galaktika.com':443
- 'ap#.#pify.org':443
UDP
- DNS ASK st####galaktika.com
- DNS ASK x1.#.lencr.org
- DNS ASK ap#.#pify.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<Current directory>\windowsservicehost.exe' --silent --force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\7b9f98ed59654f119d000cca46e7fa35.ps1"
- '<Current directory>\windowsservicehost.exe' --healthcheck
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\b8e8995b50e34b3c8be408f3d5c96db0.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\b00d256644b840a6a78dfa8bbad706c0.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\6747c23b11ff4f34bc60135f910f5bc9.ps1"
Executes the following
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "<Current directory>\" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\icacls.exe' <Current directory> /reset /T /C /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_d2b1c9ce7de84509b09bc549fd0707ee.bat"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 0 actions= ""/""/""
- '<SYSTEM32>\sc.exe' stop "WindowsServiceHost"
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '<SYSTEM32>\xcopy.exe' "<Current directory>\*" "<Current directory>.rollback\" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_7f4d5651dc2046f5815ce6099b9d2b88\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\xcopy.exe' "<Current directory>.rollback\*" "<Current directory>\" /E /Y /Q
- '<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 86400 actions= restart/1000/restart/2000/restart/5000
- '<SYSTEM32>\sc.exe' failureflag "WindowsServiceHost" 1
- '<SYSTEM32>\sc.exe' start "WindowsServiceHost"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_463e24c35fa746c7b6f6c5cf2659330d.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_226815c1c99d4428a679b68c5177e0c6\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_fc38ece863f848ee82ecb4407bfa2371.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_d7f443f6e1e84452a31165f25bda1f98\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_31f8e17c32d94a03b1873b695fabc011.bat"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_9ce01feb2c4d44348036c442a092607b\*" "<Current directory>" /E /Y /Q
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\ca2537c764874dbab9049d7ca6f8ff83.ps1"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_153fba46810e45cea64fe23618ca6d1b.bat"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_d2b1c9ce7de84509b09bc549fd0707ee.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_463e24c35fa746c7b6f6c5cf2659330d.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_fc38ece863f848ee82ecb4407bfa2371.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_31f8e17c32d94a03b1873b695fabc011.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_153fba46810e45cea64fe23618ca6d1b.bat"' (with hidden window)
