Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\lol.bat
- <SYSTEM32>\tasks\googleupdatetaskmachineqc
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Faxdos] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Faxdos] 'ImagePath' = '%ALLUSERSPROFILE%\Logs\fpuiriep.exe'
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '<SYSTEM32>\config\systemprofile\AppData\Roaming\Google\Libs\WR64.sys'
Creates the following services
- 'Faxdos' %ALLUSERSPROFILE%\Logs\fpuiriep.exe
- 'WinRing0_1_2_0' <SYSTEM32>\config\systemprofile\AppData\Roaming\Google\Libs\WR64.sys
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %WINDIR%\temp\lol.vbs
- %WINDIR%\temp\run.bat
- %WINDIR%\temp\s.exe
- %WINDIR%\temp\setup.exe
- %WINDIR%\temp\lol.bat
- %ALLUSERSPROFILE%\logs\fpuiriep.exe
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\logs\fpuiriep.exe
Network activity
Connects to
- 'ip###ger.org':443
- '45.##.229.148':80
- 'ta####ealprize.life':443
TCP
HTTP GET requests
- http://45.##.229.148/9bqgih7yhlahsrceieumi.php
- http://45.##.229.148/rmd9czilafssfk6w0phfc.php
Other
- 'ip###ger.org':443
- 'ta####ealprize.life':443
UDP
- DNS ASK ip###ger.org
- DNS ASK ta####ealprize.life
- DNS ASK st#####-eu.rplant.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\Temp\lol.vbs"
- '%WINDIR%\temp\s.exe'
- '%WINDIR%\temp\setup.exe'
- '%ProgramFiles%\chrome\updater.exe'
- '%ProgramFiles%\chrome\updater.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Temp\run.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Temp\lol.bat" "
- '%WINDIR%\syswow64\svchost.exe' -k netsvcs
