Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\is-opbqa.tmp\<File name>.tmp
- %TEMP%\is-ghhr9.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ghhr9.tmp\lcbkoaekwf.dll
- %TEMP%\is-ssrh9.tmp\<File name>.tmp
- %TEMP%\is-3jrc8.tmp\_isetup\_setup64.tmp
- %TEMP%\is-3jrc8.tmp\lcbkoaekwf.dll
Deletes following files that it created itself
- %TEMP%\is-ghhr9.tmp\lcbkoaekwf.dll
- %TEMP%\is-ghhr9.tmp\_isetup\_setup64.tmp
- %TEMP%\is-opbqa.tmp\<File name>.tmp
- %TEMP%\is-ssrh9.tmp\<File name>.tmp
Network activity
Connects to
- 'mo#####.map.fastly.net':443
UDP
- DNS ASK do##dns.com
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Creates and executes the following
- '%TEMP%\is-opbqa.tmp\<File name>.tmp' /SL5="$80188,4765697,916480,<Full path to file>"
- '%TEMP%\is-ssrh9.tmp\<File name>.tmp' /SL5="$90188,4765697,916480,<Full path to file>" /VERYSILENT
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\explorer.exe'
