Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im "6293dedf7e6b5_d3fac9c35d.exe" /f
- '%WINDIR%\syswow64\taskkill.exe' /im "6293dee2688d4_cda143c.exe" /f
Injects code into
the following user processes:
- 6293dee14595c_57b8f53f4.exe
Modifies file system
Creates the following files
- %TEMP%\nsue43.tmp
- %TEMP%\nsi5ep.dzg
- %TEMP%\is-ljduv.tmp\idp.dll
- %TEMP%\is-ljduv.tmp\_isetup\_setup64.tmp
- %TEMP%\is-lk2ru.tmp\lbo5.exe
- %TEMP%\is-gjj7g.tmp\6293dedb5015b_715a0a1.tmp
- %TEMP%\is-b9q2s.tmp\idp.dll
- %TEMP%\is-b9q2s.tmp\_isetup\_setup64.tmp
- %TEMP%\is-lk2ru.tmp\idp.dll
- %TEMP%\is-lk2ru.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-lk2ru.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ncu9p.tmp\6293dee37a414_5180f88f09.tmp
- %TEMP%\is-6hk53.tmp\6293dedb5015b_715a0a1.tmp
- %TEMP%\7zs873b301c\setup_install.exe
- %TEMP%\7zs873b301c\libwinpthread-1.dll
- %TEMP%\7zs873b301c\libstdc++-6.dll
- %TEMP%\7zs873b301c\libgcc_s_dw2-1.dll
- %TEMP%\7zs873b301c\6293dee425718_fe666603bd.exe
- %TEMP%\7zs873b301c\6293dee37a414_5180f88f09.exe
- %TEMP%\7zs873b301c\6293dee2688d4_cda143c.exe
- %TEMP%\7zs873b301c\6293dee14595c_57b8f53f4.exe
- %TEMP%\7zs873b301c\6293dee06f290_dac67f9.exe
- %TEMP%\7zs873b301c\6293dedf7e6b5_d3fac9c35d.exe
- %TEMP%\7zs873b301c\6293dede32330_78924a9.exe
- %TEMP%\7zs873b301c\6293dedc18960_fb5671e90.exe
- %TEMP%\7zs873b301c\6293dedb5015b_715a0a1.exe
- %TEMP%\7zs873b301c\6293ded489cb0_7e74be6d.exe
- %TEMP%\7zs873b301c\6293ded3ce654_21b736.exe
- %TEMP%\7zs873b301c\6293ded2f0bfb_ec774ab5e.exe
- %TEMP%\setup_installer.exe
- %TEMP%\is-ljduv.tmp\service.dll
- %ProgramFiles(x86)%\myinstaller\is-s99fq.tmp
Deletes the following files
- %TEMP%\7zs873b301c\6293ded2f0bfb_ec774ab5e.exe
- %TEMP%\7zs873b301c\6293ded3ce654_21b736.exe
- %TEMP%\is-b9q2s.tmp\idp.dll
- %TEMP%\is-b9q2s.tmp\_isetup\_setup64.tmp
- %TEMP%\is-6hk53.tmp\6293dedb5015b_715a0a1.tmp
- %TEMP%\7zs873b301c\6293dedf7e6b5_d3fac9c35d.exe
- %TEMP%\7zs873b301c\6293dee2688d4_cda143c.exe
- %TEMP%\is-ljduv.tmp\idp.dll
- %TEMP%\is-ljduv.tmp\service.dll
- %TEMP%\is-ljduv.tmp\_isetup\_setup64.tmp
- %TEMP%\is-gjj7g.tmp\6293dedb5015b_715a0a1.tmp
- %TEMP%\7zs873b301c\6293dedc18960_fb5671e90.exe
Moves the following files
- from %ProgramFiles(x86)%\myinstaller\is-s99fq.tmp to %ProgramFiles(x86)%\myinstaller\unins000.exe
Network activity
Connects to
- '37.#.8.39':80
- 'ip##pi.com':80
- 'ka########yama.s3.pl-waw.scw.cloud':80
- 'cr#######e.s3.pl-waw.scw.cloud':80
- 'v.###gamev.com':443
- 'mu###low.com':80
- 'microsoft.com':80
TCP
HTTP GET requests
- http://37.#.8.39/access.php?su######################################
- http://ip##pi.com/json/
- http://ka########yama.s3.pl-waw.scw.cloud/cul-pubpoweroff.exe
- http://cr#######e.s3.pl-waw.scw.cloud/adv-matrix/poweroff.exe
- http://mu###low.com/77.dll
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'v.###gamev.com':443
UDP
- DNS ASK ip##pi.com
- DNS ASK gl###fud.com
- DNS ASK ka########yama.s3.pl-waw.scw.cloud
- DNS ASK cr#######e.s3.pl-waw.scw.cloud
- DNS ASK v.###gamev.com
- DNS ASK mu###low.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\setup_installer.exe'
- '%TEMP%\7zs873b301c\6293dee14595c_57b8f53f4.exe'
- '%TEMP%\is-lk2ru.tmp\lbo5.exe' /S /UID=1405
- '%TEMP%\is-gjj7g.tmp\6293dedb5015b_715a0a1.tmp' /SL5="$150146,921146,831488,%TEMP%\7zS873B301C\6293dedb5015b_715a0a1.exe" /VERYSILENT
- '%TEMP%\7zs873b301c\6293dedb5015b_715a0a1.exe' /VERYSILENT
- '%TEMP%\7zs873b301c\6293ded489cb0_7e74be6d.exe' -h
- '%TEMP%\is-ncu9p.tmp\6293dee37a414_5180f88f09.tmp' /SL5="$A0236,506127,422400,%TEMP%\7zS873B301C\6293dee37a414_5180f88f09.exe"
- '%TEMP%\is-6hk53.tmp\6293dedb5015b_715a0a1.tmp' /SL5="$9023A,921146,831488,%TEMP%\7zS873B301C\6293dedb5015b_715a0a1.exe"
- '%TEMP%\7zs873b301c\6293ded489cb0_7e74be6d.exe'
- '%TEMP%\7zs873b301c\6293dee37a414_5180f88f09.exe'
- '%TEMP%\7zs873b301c\6293dee2688d4_cda143c.exe'
- '%TEMP%\7zs873b301c\6293dedb5015b_715a0a1.exe'
- '%TEMP%\7zs873b301c\6293dee06f290_dac67f9.exe'
- '%TEMP%\7zs873b301c\6293dede32330_78924a9.exe'
- '%TEMP%\7zs873b301c\6293dee425718_fe666603bd.exe'
- '%TEMP%\7zs873b301c\setup_install.exe'
- '%TEMP%\7zs873b301c\6293dedf7e6b5_d3fac9c35d.exe' /mixtwo
- '%TEMP%\7zs873b301c\6293dedc18960_fb5671e90.exe'
- '%TEMP%\is-lk2ru.tmp\lbo5.exe' /S /UID=1405' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "6293dedf7e6b5_d3fac9c35d.exe" /f & erase "%TEMP%\7zS873B301C\6293dedf7e6b5_d3fac9c35d.exe" & exit' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "6293dee2688d4_cda143c.exe" /f & erase "%TEMP%\7zS873B301C\6293dee2688d4_cda143c.exe" & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "6293dee2688d4_cda143c.exe" /f & erase "%TEMP%\7zS873B301C\6293dee2688d4_cda143c.exe" & exit
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "6293dedf7e6b5_d3fac9c35d.exe" /f & erase "%TEMP%\7zS873B301C\6293dedf7e6b5_d3fac9c35d.exe" & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
- '%WINDIR%\syswow64\cmd.exe' /c 6293dee37a414_5180f88f09.exe
- '%WINDIR%\syswow64\cmd.exe' /c 6293dee14595c_57b8f53f4.exe
- '%WINDIR%\syswow64\cmd.exe' /c 6293dee425718_fe666603bd.exe
- '%WINDIR%\syswow64\cmd.exe' /c 6293dee2688d4_cda143c.exe
- '%WINDIR%\syswow64\cmd.exe' /c 6293dee06f290_dac67f9.exe
- '%WINDIR%\syswow64\cmd.exe' /c 6293dede32330_78924a9.exe
- '%WINDIR%\syswow64\cmd.exe' /c 6293dedb5015b_715a0a1.exe
- '%WINDIR%\syswow64\cmd.exe' /c 6293dedf7e6b5_d3fac9c35d.exe /mixtwo
- '%WINDIR%\syswow64\cmd.exe' /c 6293ded3ce654_21b736.exe
- '%WINDIR%\syswow64\cmd.exe' /c 6293dedc18960_fb5671e90.exe
- '%WINDIR%\syswow64\cmd.exe' /c 6293ded489cb0_7e74be6d.exe
- '%WINDIR%\syswow64\cmd.exe' /c 6293ded2f0bfb_ec774ab5e.exe
- '%WINDIR%\syswow64\control.exe' .\NSi5EP.DZG
- '%WINDIR%\syswow64\rundll32.exe' Shell32.dll,Control_RunDLL .\NSi5EP.DZG
