Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\TOPSOCSR] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\TOPSOCSR] 'ImagePath' = '%ALLUSERSPROFILE%\rcmeotmtrtmm\szlvtzbcbfby.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\WinRing0x64.sys'
Creates the following services
- 'TOPSOCSR' %ALLUSERSPROFILE%\rcmeotmtrtmm\szlvtzbcbfby.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\WinRing0x64.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\dialer.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\rcmeotmtrtmm\szlvtzbcbfby.exe
- %WINDIR%\temp\__psscriptpolicytest_konopecd.0zr.ps1
- %WINDIR%\temp\__psscriptpolicytest_ojeujcwj.ryf.psm1
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-13-370.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-13-593.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-13-673.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-13-821.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-13-862.dump
- %WINDIR%\temp\__psscriptpolicytest_l3vcdchl.l4t.ps1
- %WINDIR%\temp\__psscriptpolicytest_zlkq1lc3.r4y.psm1
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-000.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-016.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-085.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-147.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-246.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-310.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-437.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-458.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-487.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-508.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-521.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-542.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-573.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-14-997.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-15-059.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-15-075.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-15-097.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-15-128.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-15-143.dump
- %WINDIR%\temp\content\6076-5188-powershell.exe-21-17-15-277.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\soclspwobkgr.sys
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_konopecd.0zr.ps1
- %WINDIR%\temp\__psscriptpolicytest_ojeujcwj.ryf.psm1
- %WINDIR%\temp\__psscriptpolicytest_l3vcdchl.l4t.ps1
- %WINDIR%\temp\__psscriptpolicytest_zlkq1lc3.r4y.psm1
Network activity
Connects to
- 'po##.#upportxmr.com':9000
- 'po####n.drpc.org':443
- 'pt#####n.duckdns.org':80
TCP
HTTP POST requests
Other
- 'pa###bin.com':443
- 'po##.#upportxmr.com':9000
UDP
- DNS ASK po##.#upportxmr.com
- DNS ASK po####n.drpc.org
- DNS ASK pa###bin.com
- DNS ASK pt#####n.duckdns.org
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\rcmeotmtrtmm\szlvtzbcbfby.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\dialer.exe'
- '<SYSTEM32>\sc.exe' delete "TOPSOCSR"
- '<SYSTEM32>\sc.exe' create "TOPSOCSR" binpath= "%ALLUSERSPROFILE%\rcmeotmtrtmm\szlvtzbcbfby.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "TOPSOCSR"
- '<SYSTEM32>\cmd.exe' /c choice /C Y /N /D Y /T 3 & Del "<Full path to file>"
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
