Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\LUQRTXKD] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\LUQRTXKD] 'ImagePath' = '%ALLUSERSPROFILE%\ruovmzfeczgj\brwpyfxgnwqp.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\yxzkonllavjj.sys'
Creates the following services
- 'LUQRTXKD' %ALLUSERSPROFILE%\ruovmzfeczgj\brwpyfxgnwqp.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\yxzkonllavjj.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\dummy_file_1.tmp
- %TEMP%\dummy_file_2.tmp
- %TEMP%\dummy_file_3.tmp
- %TEMP%\dummy_file_0.tmp
- %TEMP%\telegram@luna_dlc.exe
- %TEMP%\anerm.exe
- %TEMP%\rarsfx0\loader.exe
- %TEMP%\rarsfx0\luna.dll
- %TEMP%\rarsfx0\minhook.x64.dll
- %TEMP%\rarsfx0\opencv_world4100.dll
- %TEMP%\rarsfx0\glew32.dll
- %ALLUSERSPROFILE%\ruovmzfeczgj\brwpyfxgnwqp.exe
- %WINDIR%\temp\__psscriptpolicytest_pw2alqlq.g3g.ps1
- %WINDIR%\temp\__psscriptpolicytest_xwouxhue.rmk.psm1
- %WINDIR%\temp\content\480-4684-powershell.exe-21-26-59-524.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-26-59-734.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-26-59-803.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-090.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-121.dump
- %WINDIR%\temp\__psscriptpolicytest_do4jsdu4.rme.ps1
- %WINDIR%\temp\__psscriptpolicytest_xzeimtwp.z24.psm1
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-320.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-341.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-393.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-489.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-604.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-679.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-784.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-816.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-845.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-877.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-901.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-932.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-00-961.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-01-337.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-01-390.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-01-422.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-01-430.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-01-465.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-01-494.dump
- %WINDIR%\temp\content\480-4684-powershell.exe-21-27-01-549.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\yxzkonllavjj.sys
Deletes following files that it created itself
- %TEMP%\dummy_file_1.tmp
- %TEMP%\dummy_file_2.tmp
- %TEMP%\dummy_file_3.tmp
- %TEMP%\dummy_file_0.tmp
- %WINDIR%\temp\__psscriptpolicytest_pw2alqlq.g3g.ps1
- %WINDIR%\temp\__psscriptpolicytest_xwouxhue.rmk.psm1
- %WINDIR%\temp\__psscriptpolicytest_do4jsdu4.rme.ps1
- %WINDIR%\temp\__psscriptpolicytest_xzeimtwp.z24.psm1
Network activity
Connects to
- 'po##.#ashvault.pro':443
- 'pa###bin.com':443
TCP
Other
- 'po##.#ashvault.pro':443
- 'pa###bin.com':443
UDP
- DNS ASK po##.#ashvault.pro
- DNS ASK pa###bin.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\telegram@luna_dlc.exe'
- '%TEMP%\anerm.exe'
- '%TEMP%\rarsfx0\loader.exe'
- '%ALLUSERSPROFILE%\ruovmzfeczgj\brwpyfxgnwqp.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' delete "LUQRTXKD"
- '<SYSTEM32>\sc.exe' create "LUQRTXKD" binpath= "%ALLUSERSPROFILE%\ruovmzfeczgj\brwpyfxgnwqp.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "LUQRTXKD"
- '<SYSTEM32>\conhost.exe'
- '%WINDIR%\explorer.exe'
