Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\ithealthmonitor
Modifies file system
Creates the following files
- %ProgramFiles%\ithealthmonitor\<File name>.exe
- nul
Network activity
Connects to
- 'bu####alassad.store':443
TCP
Other
- 'bu####alassad.store':443
UDP
- DNS ASK bu####alassad.store
- DNS ASK yo######lback-domain.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles%\ithealthmonitor\<File name>.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /Delete /TN ITHealthMonitor /F
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 2 /TN ITHealthMonitor /TR "\"%ProgramFiles%\ITHealthMonitor\<File name>.exe\"" /F /RL HIGHEST
- '<SYSTEM32>\schtasks.exe' /Delete /TN ITHealthMonitor /F' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 2 /TN ITHealthMonitor /TR "\"%ProgramFiles%\ITHealthMonitor\<File name>.exe\"" /F /RL HIGHEST' (with hidden window)
