Trojan.DownLoader34.5016

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'windows0x64' = '%APPDATA%\Microsoft\windows0x64\svchost.vbs'

Modifies file system

Creates the following files

%TEMP%\cea1.tmp\cea2.tmp\cea3.bat
%TEMP%\_mei21402\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei21402\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei21402\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei21402\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei21402\unicodedata.pyd
%TEMP%\_mei21402\ucrtbase.dll
%TEMP%\_mei21402\select.pyd
%TEMP%\_mei21402\python37.dll
%TEMP%\_mei21402\pyexpat.pyd
%TEMP%\_mei21402\libssl-1_1-x64.dll
%TEMP%\_mei21402\libcrypto-1_1-x64.dll
%TEMP%\_mei21402\hellminer.exe.manifest
%TEMP%\_mei21402\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei21402\_lzma.pyd
%TEMP%\_mei21402\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei21402\api-ms-win-core-file-l1-1-0.dll
%APPDATA%\microsoft\windows0x64\setup.bat
%APPDATA%\microsoft\windows0x64\run.bat
%APPDATA%\microsoft\windows0x64\install.vbs
%APPDATA%\microsoft\windows0x64\install.bat
%APPDATA%\microsoft\windows0x64\check.bat
%TEMP%\cea1.tmp\windows0x64.exe
%TEMP%\cea1.tmp\verus-solver.exe
%TEMP%\cea1.tmp\windows0x64.bat
%TEMP%\cea1.tmp\update.vbs
%TEMP%\cea1.tmp\svchost.vbs
%TEMP%\cea1.tmp\start.vbs
%TEMP%\cea1.tmp\setup.bat
%TEMP%\cea1.tmp\run.bat
%TEMP%\cea1.tmp\install.vbs
%TEMP%\cea1.tmp\install.bat
%TEMP%\cea1.tmp\check.bat
%APPDATA%\microsoft\windows0x64\svchost.vbs
%APPDATA%\microsoft\windows0x64\update.vbs
%APPDATA%\microsoft\windows0x64\start.vbs
%APPDATA%\microsoft\windows0x64\verus-solver.exe
%TEMP%\_mei21402\api-ms-win-core-errorhandling-l1-1-0.dll
%APPDATA%\microsoft\windows0x64\windows0x64.bat
%TEMP%\_mei21402\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei21402\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei21402\_ssl.pyd
%TEMP%\_mei21402\_socket.pyd
%TEMP%\_mei21402\_queue.pyd
%TEMP%\_mei21402\_overlapped.pyd
%TEMP%\_mei21402\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei21402\base_library.zip
%TEMP%\_mei21402\_hashlib.pyd
%TEMP%\_mei21402\_decimal.pyd
%TEMP%\_mei21402\_ctypes.pyd
%TEMP%\_mei21402\_contextvars.pyd
%TEMP%\_mei21402\_bz2.pyd
%TEMP%\_mei21402\_asyncio.pyd
%TEMP%\_mei21402\vcruntime140.dll
%APPDATA%\microsoft\windows0x64\windows0x64.exe
%TEMP%\_mei21402\_multiprocessing.pyd
%TEMP%\62_7hdib

Deletes the following files

%TEMP%\cea1.tmp\cea2.tmp\cea3.bat
%TEMP%\cea1.tmp\check.bat
%TEMP%\cea1.tmp\install.bat
%TEMP%\cea1.tmp\install.vbs
%TEMP%\cea1.tmp\run.bat
%TEMP%\cea1.tmp\start.vbs
%TEMP%\cea1.tmp\svchost.vbs
%TEMP%\cea1.tmp\update.vbs
%TEMP%\cea1.tmp\verus-solver.exe
%TEMP%\cea1.tmp\windows0x64.bat
%TEMP%\cea1.tmp\windows0x64.exe
%TEMP%\62_7hdib

Network activity

TCP

'13#.#9.123.225':3956

Miscellaneous

Creates and executes the following

'<SYSTEM32>\wscript.exe' "%TEMP%\CEA1.tmp\install.vbs"
'<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\windows0x64\svchost.vbs"
'<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\windows0x64\start.vbs"
'%APPDATA%\microsoft\windows0x64\windows0x64.exe' -c stratum+tcp://ap.luckpool.net:3956#xnsub -u RRdTxn5aKZUt1pEfyHYver7C3WWvhNHpHa.jaipur -p x --cpu 1
'%APPDATA%\microsoft\windows0x64\verus-solver.exe' -verus2 --cpu 0
'<SYSTEM32>\cmd.exe' /c "%TEMP%\CEA1.tmp\CEA2.tmp\CEA3.bat <Full path to file>"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\setup.bat" "' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\install.bat" "' (with hidden window)
'<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\windows0x64\start.vbs"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\windows0x64.bat" "' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\check.bat" "' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\windows0x64.bat" "' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\check.bat" "' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c "%TEMP%\CEA1.tmp\CEA2.tmp\CEA3.bat <Full path to file>"
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\setup.bat" "
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\install.bat" "
'<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "windows0x64" /t REG_SZ /d ""%APPDATA%"\Microsoft\windows0x64\svchost.vbs" /f
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%HOMEPATH%\AppData"
'<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\windows0x64.bat" "
'<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\check.bat" "
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\windows0x64.bat" "
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\check.bat" "
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq Taskmgr.exe"
'<SYSTEM32>\find.exe' /I /N "Taskmgr.exe"