Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\RDPDefender] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\RDPDefender] 'ImagePath' = '%ALLUSERSPROFILE%\RDPDefender\HealthTool.exe'
Creates the following services
- 'RDPDefender' %ALLUSERSPROFILE%\RDPDefender\HealthTool.exe
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\rdpdefender\healthtool.exe
- %WINDIR%\temp\pigdybxhplbb.sys
Network activity
Connects to
- 'xm#####.nanopool.org':10343
TCP
Other
- 'xm#####.nanopool.org':10343
UDP
- DNS ASK xm#####.nanopool.org
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\rdpdefender\healthtool.exe'
Executes the following
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' delete "RDPDefender"
- '<SYSTEM32>\sc.exe' create "RDPDefender" binpath= "%ALLUSERSPROFILE%\RDPDefender\HealthTool.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "RDPDefender"
- '<SYSTEM32>\cmd.exe' /c choice /C Y /N /D Y /T 3 & Del "<Full path to file>"
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
- '%WINDIR%\explorer.exe'
