Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RegHost' = '%APPDATA%\Microsoft\RegHost.exe'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %WINDIR%\WinRing0x64.sys
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\reghost.exe
- %APPDATA%\microsoft\regmodule.exe
- %APPDATA%\microsoft\onedrive.exe
- %APPDATA%\microsoft\regdata.exe
Network activity
Connects to
- '18#.#37.234.33':8080
- 'xm#.#miners.com':2222
TCP
HTTP GET requests
- http://18#.##7.234.33:8080/hs via 18#.#37.234.33
- http://18#.##7.234.33:8080/lm via 18#.#37.234.33
- http://18#.##7.234.33:8080/xr via 18#.#37.234.33
- http://18#.##7.234.33:8080/wd via 18#.#37.234.33
Other
- 'xm#.#miners.com':2222
UDP
- DNS ASK xm#.#miners.com
Miscellaneous
Executes the following
- '%WINDIR%\bfsvc.exe' --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d --worker dad --dualmode TONDUAL --dualpool wss://eu1.stratum.ton-pool.com/stratum --dualuser E...
- '%WINDIR%\notepad.exe' --coin=XMR -o xmr.2miners.com:2222 -u 497qdSyfY8t9dYnAGTnk8UigUbUPL4MXTFAxobWPDZ5rReSiVNL22GEGt9ptgNbDbTe3qyj3oRq2LfEYbws8yGqnSjBWHR6 -p dad
- '%WINDIR%\explorer.exe' "None" "" "dad" "etc"
