Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\windefscan
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_860220] 'ImagePath' = 'cmd /c move %WINDIR%\temp\859877 "%ProgramFiles%\StarRail.exe"'
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_860985] 'ImagePath' = 'cmd /c move %WINDIR%\temp\859971 "%ProgramFiles%\StarRailBase.dll"'
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_861733] 'ImagePath' = 'cmd /c move %WINDIR%\temp\860080 "%ProgramFiles%\StarRailBase.dat"'
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_862264] 'ImagePath' = '"%ProgramFiles%\StarRail.exe"'
Creates the following services
- 'CreateSvcRpc_860220' cmd /c move %WINDIR%\temp\859877 "%ProgramFiles%\StarRail.exe"
- 'CreateSvcRpc_860985' cmd /c move %WINDIR%\temp\859971 "%ProgramFiles%\StarRailBase.dll"
- 'CreateSvcRpc_861733' cmd /c move %WINDIR%\temp\860080 "%ProgramFiles%\StarRailBase.dat"
- 'CreateSvcRpc_862264' "%ProgramFiles%\StarRail.exe"
- 'CreateSvcRpc_862264' %ProgramFiles%\StarRail.exe
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dllhost.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %WINDIR%\temp\859877
- %WINDIR%\temp\859971
- %WINDIR%\temp\860080
Moves the following files
- from %WINDIR%\temp\859877 to %ProgramFiles%\starrail.exe
- from %WINDIR%\temp\859971 to %ProgramFiles%\starrailbase.dll
- from %WINDIR%\temp\860080 to %ProgramFiles%\starrailbase.dat
- from %ProgramFiles%\starrail.exe to <SYSTEM32>\windefscan\starrail.exe
- from %ProgramFiles%\starrailbase.dll to <SYSTEM32>\windefscan\starrailbase.dll
- from %ProgramFiles%\starrailbase.dat to <SYSTEM32>\windefscan\starrailbase.dat
Network activity
Connects to
- '10#.#01.178.210':6639
- '10#.#01.178.210':80
UDP
- 'localhost':49731
- 'localhost':49733
- 'localhost':49735
- 'localhost':49737
- 'localhost':49739
Miscellaneous
Creates and executes the following
- '%ProgramFiles%\starrail.exe'
- '<SYSTEM32>\windefscan\starrail.exe' -svc
Executes the following
- '<SYSTEM32>\cmd.exe' /c move %WINDIR%\temp\859877 "%ProgramFiles%\StarRail.exe"
- '<SYSTEM32>\cmd.exe' /c move %WINDIR%\temp\859971 "%ProgramFiles%\StarRailBase.dll"
- '<SYSTEM32>\cmd.exe' /c move %WINDIR%\temp\860080 "%ProgramFiles%\StarRailBase.dat"
- '<SYSTEM32>\svchost.exe' -Install
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\svchost.exe' -Install' (with hidden window)
- '<SYSTEM32>\windefscan\starrail.exe' -svc' (with hidden window)
