Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\99674589\nss3.dll
- %TEMP%\99674589\softokn3.dll
- %TEMP%\99674589\freebl3.dll
- %TEMP%\99674589\nssutil3.dll
- %TEMP%\99674589\plds4.dll
- %TEMP%\99674589\plc4.dll
- %TEMP%\99674589\nspr4.dll
- %TEMP%\99674589\sqlite3.dll
- %TEMP%\1069659016.exe
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\xadx8
- %TEMP%\a
- %TEMP%\amn.exe
- %TEMP%\sgrmbroker.com
- %TEMP%\xhrs6
- %TEMP%\nsp699a.tmp\ckjlv.dll
- %TEMP%\yduc.com
- %TEMP%\oxjv.com
- %TEMP%\xsjpu.com
- %TEMP%\nsp699a.tmp\system.dll
- %TEMP%\nsp699a.tmp\prljyr.dll
- %TEMP%\an_krot_1704.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- nul
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020041820200419\index.dat
Deletes the following files
- %TEMP%\oxjv.com
- %TEMP%\yduc.com
- %TEMP%\a
- %TEMP%\nsp699a.tmp\ckjlv.dll
- %TEMP%\nsp699a.tmp\prljyr.dll
- %TEMP%\nsp699a.tmp\system.dll
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://gf###skfht.xyz/
- http://gf###skfht.xyz/iZjjetr9gOidLRaG/util.php?id######################
- http://ch#####.amazonaws.com/
- http://www.ge###ugin.net/json.gp?ip###############
HTTP POST requests
- http://17#.##7.91.2:6677/IRemotePanel via 17#.#57.91.2
UDP
- DNS ASK b.###sine.ru
- DNS ASK ma##r.info
- DNS ASK b.###waikin.ru
- DNS ASK t3##.##ithingware.ru
- DNS ASK gf###skfht.xyz
- DNS ASK ch#####.amazonaws.com
- DNS ASK ge###ugin.net
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%TEMP%\an_krot_1704.exe'
- '%TEMP%\amn.exe'
- '%TEMP%\sgrmbroker.com' A
- '%TEMP%\1069659016.exe'
- '%WINDIR%\syswow64\cmd.exe' /c <nul set /p ="M" > SgrmBroker.com & type oXjV.com >> SgrmBroker.com & del oXjV.com & certutil -decode yduc.com A & SgrmBroker.com A & ping 127.0.0.1 -n 2 > nul & del yduc.com & del A' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c <nul set /p ="M" > SgrmBroker.com & type oXjV.com >> SgrmBroker.com & del oXjV.com & certutil -decode yduc.com A & SgrmBroker.com A & ping 127.0.0.1 -n 2 > nul & del yduc.com & del A
- '%WINDIR%\syswow64\certutil.exe' -decode yduc.com A
- '%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %TEMP%\XhrS6
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 2
- '%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %TEMP%\XaDX8
- '%WINDIR%\syswow64\svchost.exe'
