Trojan.Siggen32.60915

Technical Information

Malicious functions

Injects code into

the following user processes:

bite.exe

Modifies file system

Creates the following files

%TEMP%\nskf903.tmp\system.dll
%TEMP%\nskf903.tmp\app-64.7z
%TEMP%\nskf903.tmp\nsis7z.dll
%TEMP%\nskf903.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nskf903.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nskf903.tmp\7z-out\icudtl.dat
%TEMP%\nskf903.tmp\7z-out\license.electron.txt
%TEMP%\nskf903.tmp\7z-out\licenses.chromium.html
%TEMP%\nskf903.tmp\7z-out\locales\af.pak
%TEMP%\nskf903.tmp\7z-out\locales\am.pak
%TEMP%\nskf903.tmp\7z-out\locales\ar.pak
%TEMP%\nskf903.tmp\7z-out\locales\bg.pak
%TEMP%\nskf903.tmp\7z-out\locales\bn.pak
%TEMP%\nskf903.tmp\7z-out\locales\ca.pak
%TEMP%\nskf903.tmp\7z-out\locales\cs.pak
%TEMP%\nskf903.tmp\7z-out\locales\da.pak
%TEMP%\nskf903.tmp\7z-out\locales\de.pak
%TEMP%\nskf903.tmp\7z-out\locales\el.pak
%TEMP%\nskf903.tmp\7z-out\locales\en-gb.pak
%TEMP%\nskf903.tmp\7z-out\locales\en-us.pak
%TEMP%\nskf903.tmp\7z-out\locales\es-419.pak
%TEMP%\nskf903.tmp\7z-out\locales\es.pak
%TEMP%\nskf903.tmp\7z-out\locales\et.pak
%TEMP%\nskf903.tmp\7z-out\locales\fa.pak
%TEMP%\nskf903.tmp\7z-out\locales\fi.pak
%TEMP%\nskf903.tmp\7z-out\locales\fil.pak
%TEMP%\nskf903.tmp\7z-out\locales\fr.pak
%TEMP%\nskf903.tmp\7z-out\locales\gu.pak
%TEMP%\nskf903.tmp\7z-out\locales\he.pak
%TEMP%\nskf903.tmp\7z-out\locales\hi.pak
%TEMP%\nskf903.tmp\7z-out\locales\hr.pak
%TEMP%\nskf903.tmp\7z-out\locales\hu.pak
%TEMP%\nskf903.tmp\7z-out\locales\id.pak
%TEMP%\nskf903.tmp\7z-out\locales\it.pak
%TEMP%\nskf903.tmp\7z-out\locales\ja.pak
%TEMP%\nskf903.tmp\7z-out\locales\kn.pak
%TEMP%\nskf903.tmp\7z-out\locales\ko.pak
%TEMP%\nskf903.tmp\7z-out\locales\lt.pak
%TEMP%\nskf903.tmp\7z-out\locales\lv.pak
%TEMP%\nskf903.tmp\7z-out\locales\ml.pak
%TEMP%\nskf903.tmp\7z-out\locales\mr.pak
%TEMP%\nskf903.tmp\7z-out\locales\ms.pak
%TEMP%\nskf903.tmp\7z-out\locales\nb.pak
%TEMP%\nskf903.tmp\7z-out\locales\nl.pak
%TEMP%\nskf903.tmp\7z-out\locales\pl.pak
%TEMP%\nskf903.tmp\7z-out\locales\pt-br.pak
%TEMP%\nskf903.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nskf903.tmp\7z-out\locales\ro.pak
%TEMP%\nskf903.tmp\7z-out\locales\ru.pak
%TEMP%\nskf903.tmp\7z-out\locales\sk.pak
%TEMP%\nskf903.tmp\7z-out\locales\sl.pak
%TEMP%\nskf903.tmp\7z-out\locales\sr.pak
%TEMP%\nskf903.tmp\7z-out\locales\sv.pak
%TEMP%\nskf903.tmp\7z-out\locales\sw.pak
%TEMP%\nskf903.tmp\7z-out\locales\ta.pak
%TEMP%\nskf903.tmp\7z-out\locales\te.pak
%TEMP%\nskf903.tmp\7z-out\locales\th.pak
%TEMP%\nskf903.tmp\7z-out\locales\tr.pak
%TEMP%\nskf903.tmp\7z-out\locales\uk.pak
%TEMP%\nskf903.tmp\7z-out\locales\ur.pak
%TEMP%\nskf903.tmp\7z-out\locales\vi.pak
%TEMP%\nskf903.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nskf903.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nskf903.tmp\7z-out\resources\app.asar
%TEMP%\nskf903.tmp\7z-out\resources.pak
%TEMP%\nskf903.tmp\7z-out\snapshot_blob.bin
%TEMP%\nskf903.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nskf903.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nskf903.tmp\7z-out\bite.exe
%TEMP%\nskf903.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nskf903.tmp\7z-out\ffmpeg.dll
%TEMP%\nskf903.tmp\7z-out\libegl.dll
%TEMP%\nskf903.tmp\7z-out\libglesv2.dll
%TEMP%\nskf903.tmp\7z-out\resources\elevate.exe
%TEMP%\nskf903.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nskf903.tmp\7z-out\vulkan-1.dll
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\bite.exe
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\chrome_100_percent.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\chrome_200_percent.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\d3dcompiler_47.dll
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\ffmpeg.dll
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\icudtl.dat
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\libegl.dll
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\libglesv2.dll
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\license.electron.txt
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\licenses.chromium.html
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\resources.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\snapshot_blob.bin
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\v8_context_snapshot.bin
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\vk_swiftshader.dll
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\vk_swiftshader_icd.json
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\vulkan-1.dll
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\af.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\am.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\ar.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\bg.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\bn.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\ca.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\cs.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\da.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\de.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\el.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\en-gb.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\en-us.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\es-419.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\es.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\et.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\fa.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\fi.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\fil.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\fr.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\gu.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\he.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\hi.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\hr.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\hu.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\id.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\it.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\ja.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\kn.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\ko.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\lt.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\lv.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\ml.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\mr.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\ms.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\nb.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\nl.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\pl.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\pt-br.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\pt-pt.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\ro.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\ru.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\sk.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\sl.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\sr.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\sv.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\sw.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\ta.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\te.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\th.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\tr.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\uk.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\ur.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\vi.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\zh-cn.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\locales\zh-tw.pak
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\resources\app.asar
%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\resources\elevate.exe
%TEMP%\nskf903.tmp\stdutils.dll
%TEMP%\a17a18d3-6f8e-471e-8cda-468bb87d087e.tmp.node
%TEMP%\04a88175-0682-4011-99b8-c5c8fc8bd2ed.tmp.node
%TEMP%\0eaa46a8-2812-4c4d-b478-0376f365b6c7.tmp.node
%APPDATA%\socarroneria\local storage\leveldb\log
%APPDATA%\socarroneria\local storage\leveldb\manifest-000001
%APPDATA%\socarroneria\local storage\leveldb\000001.dbtmp
%APPDATA%\socarroneria\code cache\js\index
%APPDATA%\socarroneria\code cache\wasm\index
%APPDATA%\socarroneria\code cache\wasm\index-dir\temp-index
%APPDATA%\socarroneria\code cache\js\index-dir\temp-index
%APPDATA%\socarroneria\gpucache\index
%APPDATA%\socarroneria\gpucache\data_0
%APPDATA%\socarroneria\gpucache\data_1
%APPDATA%\socarroneria\gpucache\data_2
%APPDATA%\socarroneria\gpucache\data_3
%APPDATA%\socarroneria\dawncache\index
%APPDATA%\socarroneria\dawncache\data_0
%APPDATA%\socarroneria\dawncache\data_1
%APPDATA%\socarroneria\dawncache\data_2
%APPDATA%\socarroneria\dawncache\data_3
%APPDATA%\microsoft\spelling\en-us\default.dic
%APPDATA%\microsoft\spelling\en-us\default.exc
%APPDATA%\microsoft\spelling\en-us\default.acl
%APPDATA%\socarroneria\network\cookies-journal
%APPDATA%\socarroneria\network\trust tokens-journal
%APPDATA%\socarroneria\network\cookies
%APPDATA%\socarroneria\network\trust tokens
%APPDATA%\socarroneria\cache\cache_data\index
%APPDATA%\socarroneria\cache\cache_data\data_0
%APPDATA%\socarroneria\cache\cache_data\data_1
%APPDATA%\socarroneria\cache\cache_data\data_2
%APPDATA%\socarroneria\cache\cache_data\data_3
%APPDATA%\socarroneria\ddc78c1d-58e1-41aa-bd27-5fdc148561b0.tmp
%APPDATA%\socarroneria\session storage\log
%APPDATA%\socarroneria\session storage\manifest-000001
%APPDATA%\socarroneria\session storage\000001.dbtmp
%APPDATA%\socarroneria\session storage\000003.log
%APPDATA%\socarroneria\7adcbab5-4686-4005-a93a-6a07aa2d7e41.tmp
%APPDATA%\socarroneria\network\1f9f6ca0-c022-4ce9-bb55-ffdaf7037456.tmp
%APPDATA%\socarroneria\network\d8841762-00ab-4fbe-8ae2-09fd4435bf75.tmp
%TEMP%\ru_nova_user_185.zip

Deletes following files that it created itself

%TEMP%\ru_nova_user_185.zip

Moves the following files

from %APPDATA%\socarroneria\code cache\js\index-dir\temp-index to %APPDATA%\socarroneria\code cache\js\index-dir\the-real-index
from %APPDATA%\socarroneria\code cache\wasm\index-dir\temp-index to %APPDATA%\socarroneria\code cache\wasm\index-dir\the-real-index
from %APPDATA%\socarroneria\local storage\leveldb\000001.dbtmp to %APPDATA%\socarroneria\local storage\leveldb\current
from %APPDATA%\socarroneria\ddc78c1d-58e1-41aa-bd27-5fdc148561b0.tmp to %APPDATA%\socarroneria\local state
from %APPDATA%\socarroneria\session storage\000001.dbtmp to %APPDATA%\socarroneria\session storage\current
from %APPDATA%\socarroneria\7adcbab5-4686-4005-a93a-6a07aa2d7e41.tmp to %APPDATA%\socarroneria\preferences
from %APPDATA%\socarroneria\network\1f9f6ca0-c022-4ce9-bb55-ffdaf7037456.tmp to %APPDATA%\socarroneria\network\network persistent state
from %APPDATA%\socarroneria\network\d8841762-00ab-4fbe-8ae2-09fd4435bf75.tmp to %APPDATA%\socarroneria\network\transportsecurity

Network activity

Connects to

'no#####reen-webview.com':443
'pl###game.com':443
'google.com':80
'st####.##oudflareinsights.com':443
'dn#.google':443
'ip##fo.io':443
'ap#.#ofile.io':443
'st######-par-7.gofile.io':443

TCP

HTTP GET requests

http://www.google.com/

Other

'pl###game.com':443
'st####.##oudflareinsights.com':443
'dn#.google':443
'ip##fo.io':443
'ap#.#ofile.io':443

UDP

DNS ASK no#####reen-webview.com
DNS ASK pl###game.com
DNS ASK google.com
DNS ASK st####.##oudflareinsights.com
DNS ASK dn#.google
DNS ASK ip##fo.io
DNS ASK no####entinel.com
DNS ASK ap#.#ofile.io
DNS ASK st######-par-7.gofile.io
DNS ASK ie###oop.info
'pl###game.com':443

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''

Creates and executes the following

'%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\bite.exe'
'%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\bite.exe' --type=gpu-process --user-data-dir="%APPDATA%\socarroneria" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAA...
'%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\bite.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\socarroneria" --mojo-platform-channel-handle=2168 --field-tria...
'%TEMP%\2kvyanszxm4yse33p6xsbvh6os5\bite.exe' --type=renderer --user-data-dir="%APPDATA%\socarroneria" --app-path="%TEMP%\2kvYanSzxm4ySe33P6XSBvh6Os5\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --devi...

Executes the following

'<SYSTEM32>\cmd.exe' /d /s /c "wmic process where processid=1484 get ExecutablePath"
'<SYSTEM32>\wbem\wmic.exe' process where processid=1484 get ExecutablePath
'<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"
'<SYSTEM32>\cmd.exe' /d /s /c "wmic OS get caption, osarchitecture | more +1"
'<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
'<SYSTEM32>\wbem\wmic.exe' OS get caption, osarchitecture
'<SYSTEM32>\more.com' +1
'<SYSTEM32>\cmd.exe' /d /s /c "wmic cpu get name | more +1"
'<SYSTEM32>\wbem\wmic.exe' cpu get name
'<SYSTEM32>\cmd.exe' /d /s /c "wmic PATH Win32_VideoController get name | more +1"
'<SYSTEM32>\wbem\wmic.exe' PATH Win32_VideoController get name
'<SYSTEM32>\cmd.exe' /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
'<SYSTEM32>\cmd.exe' /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
'<SYSTEM32>\cmd.exe' /d /s /c "mullvad account get"
'<SYSTEM32>\cmd.exe' /d /s /c "powershell Get-Clipboard"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-Clipboard
'<SYSTEM32>\cmd.exe' /d /s /c "wmic process where processid=1484 get ExecutablePath"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic OS get caption, osarchitecture | more +1"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic cpu get name | more +1"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic PATH Win32_VideoController get name | more +1"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "mullvad account get"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell Get-Clipboard"' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней