Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%TEMP%\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %TEMP%\WinRing0x64.sys
Modifies file system
Creates the following files
- %TEMP%\dilhost.exe
- %TEMP%\0chqr40c.bat
- nul
Sets the 'hidden' attribute to the following files
- %TEMP%\dilhost.exe
Network activity
Connects to
- 'xm#.##inrarigs.com':3333
TCP
Other
- 'xm#.##inrarigs.com':3333
UDP
- DNS ASK xm#.##inrarigs.com
Miscellaneous
Creates and executes the following
- '%TEMP%\dilhost.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\0CHQR40C.bat" "<Full path to file>" "
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\tasklist.exe' /fi "IMAGENAME eq dIlhost.exe"
- '<SYSTEM32>\find.exe' /i "dIlhost.exe"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\0CHQR40C.bat" "<Full path to file>" "' (with hidden window)
