Trojan.Siggen32.3840

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\defendnot
<SYSTEM32>\tasks\boost

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '<Current directory>'"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\xaomi'"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Temp'"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionProcess '<SYSTEM32>\cmd.exe'"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionProcess '<SYSTEM32>\clip.exe'"

Injects code into

the following system processes:

<SYSTEM32>\taskmgr.exe

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\taskmgr.exe

Modifies file system

Creates the following files

%TEMP%\_mei60162\vcruntime140.dll
%TEMP%\_mei60162\vcruntime140_1.dll
%TEMP%\_mei60162\_bz2.pyd
%TEMP%\_mei60162\_ctypes.pyd
%TEMP%\_mei60162\_decimal.pyd
%TEMP%\_mei60162\_hashlib.pyd
%TEMP%\_mei60162\_lzma.pyd
%TEMP%\_mei60162\_socket.pyd
%TEMP%\_mei60162\_uuid.pyd
%TEMP%\_mei60162\_wmi.pyd
%TEMP%\_mei60162\base_library.zip
%TEMP%\_mei60162\data_pack\bip39.txt
%TEMP%\_mei60162\data_pack\boost.js
%TEMP%\_mei60162\data_pack\defendnot.dll
%TEMP%\_mei60162\data_pack\netclient.cpp
%TEMP%\_mei60162\data_pack\svcup.exe
%TEMP%\_mei60162\data_pack\xaomi.js
%TEMP%\_mei60162\data_pack\xaomi.xml
%TEMP%\_mei60162\libcrypto-3.dll
%TEMP%\_mei60162\libffi-8.dll
%TEMP%\_mei60162\pyarmor_runtime_000000\pyarmor_runtime.pyd
%TEMP%\_mei60162\python313.dll
%TEMP%\_mei60162\select.pyd
%TEMP%\_mei60162\unicodedata.pyd
C:\users\public\music\xaomi\defendnot.dll
C:\users\public\music\xaomi\netclient.cpp
nul
C:\users\public\music\xaomi\ctx.bin
C:\users\public\music\xaomi\country.inf
C:\users\public\music\xaomi\xaomi.js
C:\users\public\music\xaomi\xaomi.xml
C:\users\public\music\xaomi\svcup.exe
C:\users\public\music\xaomi\bip39.txt
C:\users\public\music\xaomi\guid

Deletes following files that it created itself

%TEMP%\_mei60162\base_library.zip
%TEMP%\_mei60162\data_pack\bip39.txt
%TEMP%\_mei60162\data_pack\boost.js
%TEMP%\_mei60162\data_pack\defendnot.dll
%TEMP%\_mei60162\data_pack\netclient.cpp
%TEMP%\_mei60162\data_pack\svcup.exe
%TEMP%\_mei60162\data_pack\xaomi.js
%TEMP%\_mei60162\data_pack\xaomi.xml
%TEMP%\_mei60162\libcrypto-3.dll
%TEMP%\_mei60162\libffi-8.dll
%TEMP%\_mei60162\pyarmor_runtime_000000\pyarmor_runtime.pyd
%TEMP%\_mei60162\python313.dll
%TEMP%\_mei60162\select.pyd
%TEMP%\_mei60162\unicodedata.pyd
%TEMP%\_mei60162\vcruntime140.dll
%TEMP%\_mei60162\vcruntime140_1.dll
%TEMP%\_mei60162\_bz2.pyd
%TEMP%\_mei60162\_ctypes.pyd
%TEMP%\_mei60162\_decimal.pyd
%TEMP%\_mei60162\_hashlib.pyd
%TEMP%\_mei60162\_lzma.pyd
%TEMP%\_mei60162\_socket.pyd
%TEMP%\_mei60162\_uuid.pyd
%TEMP%\_mei60162\_wmi.pyd

Network activity

Connects to

'ip##fo.io':443
'x1.#.lencr.org':80
'r1#.#.lencr.org':80
'mo#####.map.fastly.net':443

TCP

HTTP GET requests

http://r1#.#.lencr.org/102.crl

Other

'ip##fo.io':443

UDP

DNS ASK ip##fo.io
DNS ASK x1.#.lencr.org
DNS ASK r1#.#.lencr.org
DNS ASK mo#####.map.fastly.net

Miscellaneous

Creates and executes the following

'C:\users\public\music\xaomi\netclient.cpp' --name Defender --silent
'<SYSTEM32>\wscript.exe' C:\Users\Public\Music\xaomi\xaomi.js
'C:\users\public\music\xaomi\svcup.exe'

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath '<Current directory>'""
'<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\xaomi'""
'<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Temp'""
'<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionProcess '<SYSTEM32>\cmd.exe'""
'<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionProcess '<SYSTEM32>\clip.exe'""
'<SYSTEM32>\cmd.exe' /c "powershell -Command "Get-MpComputerStatus | Out-Null""
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-MpComputerStatus | Out-Null"
'<SYSTEM32>\taskmgr.exe'
'<SYSTEM32>\curl.exe' -s --max-time 10 https://ipinfo.io/country
'<SYSTEM32>\cmd.exe' /c "schtasks /create /tn boost /xml C:\Users\Public\Music\xaomi\xaomi.xml /f"
'<SYSTEM32>\schtasks.exe' /create /tn boost /xml C:\Users\Public\Music\xaomi\xaomi.xml /f
'<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath '<Current directory>'""' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\xaomi'""' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Temp'""' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionProcess '<SYSTEM32>\cmd.exe'""' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionProcess '<SYSTEM32>\clip.exe'""' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "powershell -Command "Get-MpComputerStatus | Out-Null""' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "schtasks /create /tn boost /xml C:\Users\Public\Music\xaomi\xaomi.xml /f"' (with hidden window)
'C:\users\public\music\xaomi\svcup.exe' ' (with hidden window)