Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSysCore' = '%LOCALAPPDATA%\Microsoft\Windows\WinX\nsedge.exe'
Malicious functions
Patches code
in AMSI dll
- vgqgrm.exe process, Amsi.dll module
in NTDLL dll
- vgqgrm.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\_mei45482\vcruntime140.dll
- %TEMP%\_mei45482\_asyncio.pyd
- %TEMP%\_mei45482\_bz2.pyd
- %TEMP%\_mei45482\_cffi_backend.cp311-win32.pyd
- %TEMP%\_mei45482\_ctypes.pyd
- %TEMP%\_mei45482\_decimal.pyd
- %TEMP%\_mei45482\_elementtree.pyd
- %TEMP%\_mei45482\_hashlib.pyd
- %TEMP%\_mei45482\_lzma.pyd
- %TEMP%\_mei45482\_multiprocessing.pyd
- %TEMP%\_mei45482\_overlapped.pyd
- %TEMP%\_mei45482\_queue.pyd
- %TEMP%\_mei45482\_socket.pyd
- %TEMP%\_mei45482\_ssl.pyd
- %TEMP%\_mei45482\base_library.zip
- %TEMP%\_mei45482\clr_loader\ffi\dlls\amd64\clrloader.dll
- %TEMP%\_mei45482\clr_loader\ffi\dlls\x86\clrloader.dll
- %TEMP%\_mei45482\cryptography-47.0.0.dist-info\installer
- %TEMP%\_mei45482\cryptography-47.0.0.dist-info\metadata
- %TEMP%\_mei45482\cryptography-47.0.0.dist-info\record
- %TEMP%\_mei45482\cryptography-47.0.0.dist-info\wheel
- %TEMP%\_mei45482\cryptography-47.0.0.dist-info\licenses\license
- %TEMP%\_mei45482\cryptography-47.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei45482\cryptography-47.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei45482\cryptography-47.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei45482\cryptography-47.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei45482\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei45482\libcrypto-3.dll
- %TEMP%\_mei45482\libffi-8.dll
- %TEMP%\_mei45482\libssl-3.dll
- %TEMP%\_mei45482\pyexpat.pyd
- %TEMP%\_mei45482\python3.dll
- %TEMP%\_mei45482\python311.dll
- %TEMP%\_mei45482\pythonnet-3.0.5.dist-info\installer
- %TEMP%\_mei45482\pythonnet-3.0.5.dist-info\metadata
- %TEMP%\_mei45482\pythonnet-3.0.5.dist-info\record
- %TEMP%\_mei45482\pythonnet-3.0.5.dist-info\wheel
- %TEMP%\_mei45482\pythonnet-3.0.5.dist-info\top_level.txt
- %TEMP%\_mei45482\pythonnet\__init__.py
- %TEMP%\_mei45482\pythonnet\runtime\python.runtime.deps.json
- %TEMP%\_mei45482\pythonnet\runtime\python.runtime.dll
- %TEMP%\_mei45482\pythonnet\runtime\python.runtime.pdb
- %TEMP%\_mei45482\pythonnet\runtime\python.runtime.xml
- %TEMP%\_mei45482\select.pyd
- %TEMP%\_mei45482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei45482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei45482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei45482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei45482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei45482\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei45482\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei45482\unicodedata.pyd
- %TEMP%\tmp4925.tmp
- %TEMP%\tmp4a5f.tmp
- %APPDATA%\microsoft\crypto\keys\b2383a326c457e2e38f7c7912ac09785_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %LOCALAPPDATA%\microsoft\windows\winx\nsedge.exe
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\winx\nsedge.exe
Deletes following files that it created itself
- %TEMP%\tmp4925.tmp
- %TEMP%\tmp4a5f.tmp
Network activity
Connects to
- 'localhost':56001
- 'localhost':56002
- 'localhost':56003
Miscellaneous
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "ver"
- '%WINDIR%\syswow64\cmd.exe' /c "ver"' (with hidden window)
