Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\LUQRTXKD] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\LUQRTXKD] 'ImagePath' = '%ALLUSERSPROFILE%\ruovmzfeczgj\brwpyfxgnwqp.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\yxzkonllavjj.sys'
Creates the following services
- 'LUQRTXKD' %ALLUSERSPROFILE%\ruovmzfeczgj\brwpyfxgnwqp.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\yxzkonllavjj.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\ruovmzfeczgj\brwpyfxgnwqp.exe
- %WINDIR%\temp\__psscriptpolicytest_w4ea3o1q.2r2.ps1
- %WINDIR%\temp\__psscriptpolicytest_bdyb3vbu.0ve.psm1
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-095.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-309.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-372.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-488.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-510.dump
- %WINDIR%\temp\__psscriptpolicytest_chmhkfkb.qkd.ps1
- %WINDIR%\temp\__psscriptpolicytest_qbgazbh1.elz.psm1
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-610.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-626.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-657.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-726.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-811.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-858.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-943.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-974.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-49-990.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-50-012.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-50-028.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-50-043.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-50-074.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-50-344.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-50-397.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-50-413.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-50-444.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-50-476.dump
- %WINDIR%\temp\content\804-4012-powershell.exe-20-24-50-513.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\yxzkonllavjj.sys
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_w4ea3o1q.2r2.ps1
- %WINDIR%\temp\__psscriptpolicytest_bdyb3vbu.0ve.psm1
- %WINDIR%\temp\__psscriptpolicytest_chmhkfkb.qkd.ps1
- %WINDIR%\temp\__psscriptpolicytest_qbgazbh1.elz.psm1
Network activity
Connects to
- 'po##.#ashvault.pro':443
- 'pa###bin.com':443
TCP
Other
- 'po##.#ashvault.pro':443
- 'pa###bin.com':443
UDP
- DNS ASK po##.#ashvault.pro
- DNS ASK pa###bin.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\ruovmzfeczgj\brwpyfxgnwqp.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' delete "LUQRTXKD"
- '<SYSTEM32>\sc.exe' create "LUQRTXKD" binpath= "%ALLUSERSPROFILE%\ruovmzfeczgj\brwpyfxgnwqp.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "LUQRTXKD"
- '<SYSTEM32>\conhost.exe'
- '%WINDIR%\explorer.exe'
