Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' /u /s "%TEMP%\Realtek(r)Audio.dll"
Modifies file system
Creates the following files
- %TEMP%\realtek(r)audio.dll
- %APPDATA%\microsoft\temp.xlsx
- %APPDATA%\microsoft\~$temp.xlsx
Network activity
Connects to
- 'ca####tokens.com':80
- 'ev######ngandthedog.shop':443
TCP
HTTP GET requests
- http://ca####tokens.com/static/images/terms/x16jsxq8bfzka32jzsatvd6tv/post.jsp
Other
- 'ev######ngandthedog.shop':443
UDP
- DNS ASK ca####tokens.com
- DNS ASK ev######ngandthedog.shop
Miscellaneous
Searches for the following windows
- ClassName: 'XLMAIN' WindowName: 'Microsoft Excel'
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' /dde
