Technical Information
Malicious functions
Injects code into
the following user processes:
- phasecontr.exe
- synapsengine.exe
- crisp.exe
Patches code
in dll
- navigator-shad64.exe process, tapisrv.dll module
- navigator-shad64.exe process, Input.dll module
- navigator-shad64.exe process, XmlLite.dll module
- navigator-shad64.exe process, RPCRT4.dll module
- crisp.exe process, XmlLite.dll module
in NTDLL dll
- navigator-shad64.exe process, ntdll.dll module
- synapsengine.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\sandbox-drv.toml
- %TEMP%\heap_proc.dll
- %TEMP%\msvcdis140.dll
- %TEMP%\msvcp_win.dll
- %TEMP%\navigator-shad64.exe
- %TEMP%\sqlite3.dll
- %TEMP%\ucrtbase.dll
- %ALLUSERSPROFILE%\json\msvcdis140.dll
- %ALLUSERSPROFILE%\json\msvcp_win.dll
- %ALLUSERSPROFILE%\json\navigator-shad64.exe
- %ALLUSERSPROFILE%\json\sandbox-drv.toml
- %ALLUSERSPROFILE%\json\sqlite3.dll
- %ALLUSERSPROFILE%\json\ucrtbase.dll
- %ALLUSERSPROFILE%\json\heap_proc.dll
- %APPDATA%\json\crisp.exe
- %APPDATA%\json\ikbtwkgmuudgv\heap_proc.dll
- %APPDATA%\json\ikbtwkgmuudgv\msvcdis140.dll
- %APPDATA%\json\ikbtwkgmuudgv\msvcp_win.dll
- %APPDATA%\json\ikbtwkgmuudgv\navigator-shad64.exe
- %APPDATA%\json\ikbtwkgmuudgv\sandbox-drv.toml
- %APPDATA%\json\ikbtwkgmuudgv\sqlite3.dll
- %APPDATA%\json\ikbtwkgmuudgv\ucrtbase.dll
- %TEMP%\f98a738.tmp
- %APPDATA%\serverhost\crisp.exe
- %TEMP%\146c35b.tmp
- %TEMP%\1d3cc84.tmp
- %TEMP%\208cfff.tmp
- %HOMEPATH%\phasecontr.exe
- %TEMP%\synapsengine.exe
- %TEMP%\39aea5e.tmp
- %TEMP%\3f3f03a.tmp
- %ALLUSERSPROFILE%\jovise\lonupuvi
- %TEMP%\90e45f9.tmp
- %ALLUSERSPROFILE%\jovise\cusak\45095d24a3012ed49fac88f01d68a8e412d73aad
- %ALLUSERSPROFILE%\jovise\cusak\2133acbae31a62b615f45a91f230ce2067e818dc
- %TEMP%\a9c0-8604-0387-2158\login data
- %TEMP%\9784-3ef0-f98b-324e\web data
- %TEMP%\150xax\u9c6rc4nqh0\default\cftvcwaisls
- %TEMP%\150xax\u9c6rc4nqh0\default\blbydmq\login data
- %TEMP%\150xax\u9c6rc4nqh0\default\blbydmq\web data
Deletes following files that it created itself
- %TEMP%\f98a738.tmp
- %TEMP%\146c35b.tmp
- %TEMP%\a9c0-8604-0387-2158\login data
- %TEMP%\9784-3ef0-f98b-324e\web data
Substitutes the following files
- %TEMP%\f98a738.tmp
- %TEMP%\146c35b.tmp
Network activity
Connects to
- '91.##.102.10':443
- '19#.#4.123.38':3333
- '19#.#4.123.38':3334
TCP
Other
- '91.##.102.10':443
- '19#.#4.123.38':3333
- '19#.#4.123.38':3334
Miscellaneous
Creates and executes the following
- '%TEMP%\navigator-shad64.exe'
- '%ALLUSERSPROFILE%\json\navigator-shad64.exe'
- '%APPDATA%\json\ikbtwkgmuudgv\navigator-shad64.exe'
- '%HOMEPATH%\phasecontr.exe'
- '%TEMP%\synapsengine.exe'
- '%APPDATA%\json\crisp.exe'
- '%APPDATA%\serverhost\crisp.exe'
