Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\desktop.ini.lnk
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\System32\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %APPDATA%\System32\WinRing0x64.sys
Modifies file system
Creates the following files
- %APPDATA%\windows\odbcad64.dll
- %APPDATA%\system32\config.json
- %APPDATA%\system32\svchost.exe
Deletes the following files
- %APPDATA%\windows\odbcad64.dll
Network activity
Connects to
- 'xm#####.nanopool.org':14444
TCP
Other
- 'xm#####.nanopool.org':14444
UDP
- DNS ASK xm#####.nanopool.org
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%APPDATA%\windows\odbcad64.dll' -p123
- '%APPDATA%\system32\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where ExecutablePath='%HomeDrive%\\Users\\%username%\\AppData\\Roaming\\system32\\svchost.exe' delete' (with hidden window)
- '%APPDATA%\windows\odbcad64.dll' -p123' (with hidden window)
- '%APPDATA%\system32\svchost.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where ExecutablePath='%HomeDrive%\\Users\\%username%\\AppData\\Roaming\\system32\\svchost.exe' delete
- '%WINDIR%\syswow64\wbem\wmic.exe' process where ExecutablePath='C:\\Users\\user\\AppData\\Roaming\\system32\\svchost.exe' delete
