Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\openwith.exe
the following user processes:
- wmpshare.exe
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- [HKCU\Software\RIT\The Bat!]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
Network activity
Connects to
- '18#.#41.216.98':443
TCP
Other
- '18#.#41.216.98':443
UDP
- DNS ASK ti####-g.nist.gov
- DNS ASK nt#.#ime.in.ua
- DNS ASK ts#.aco.net
- DNS ASK nt##.##t.berkeley.edu
- DNS ASK nt#.nict.jp
- DNS ASK ti##.apple.com
- DNS ASK nt##.hetzner.de
- 'nt##.hetzner.de':123
- 'ti##.apple.com':123
- 'ti####-g.nist.gov':123
- 'time.windows.com':123
- 'nt#.#ime.in.ua':123
- 'ts#.aco.net':123
- 'nt##.##t.berkeley.edu':123
- 'nt#.nict.jp':123
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: 'TeamViewer'
Executes the following
- '<SYSTEM32>\openwith.exe'
- '%ProgramFiles%\windows media player\wmpshare.exe'
