Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\timeflow.lnk
Malicious functions
Executes the following
- '<SYSTEM32>\at.exe'
Injects code into
the following user processes:
- regasm.exe
Modifies file system
Creates the following files
- %TEMP%\.tmp3ehn8i\progr1.7z
- %TEMP%\.tmp3ehn8i\progr1.exe
- %TEMP%\.tmp3ehn8i\progr2.7z
- %TEMP%\.tmp3ehn8i\progr2.exe
- %TEMP%\ixp000.tmp\towns.vob
- %TEMP%\ixp000.tmp\pst.vob
- %TEMP%\ixp000.tmp\entitled.vob
- %TEMP%\ixp000.tmp\integer.vob
- %TEMP%\ixp000.tmp\procedures.vob
- %TEMP%\ixp000.tmp\sensitivity
- %TEMP%\ixp000.tmp\campaign
- %TEMP%\ixp000.tmp\brief
- %TEMP%\ixp000.tmp\buying
- %TEMP%\ixp000.tmp\expensive
- %TEMP%\ixp000.tmp\women
- %TEMP%\ixp000.tmp\drilling
- %TEMP%\ixp000.tmp\dam
- %TEMP%\ixp000.tmp\undertaken
- %TEMP%\ixp000.tmp\irs
- %TEMP%\ixp000.tmp\garcia
- %TEMP%\ixp000.tmp\prescribed
- %TEMP%\ixp000.tmp\685876\listen.scr
- %TEMP%\ixp000.tmp\685876\y
- %LOCALAPPDATA%\chronometrics software co\r
- %LOCALAPPDATA%\chronometrics software co\timeflow.bat
- %LOCALAPPDATA%\chronometrics software co\timeflow.lnk
- %TEMP%\ixp000.tmp\685876\regasm.exe
- %APPDATA%\logs\10-29-2025
Deletes following files that it created itself
- %TEMP%\.tmp3ehn8i\progr1.7z
- %TEMP%\.tmp3ehn8i\progr1.exe
- %TEMP%\ixp000.tmp\685876\y
- %TEMP%\ixp000.tmp\procedures.vob
- %TEMP%\ixp000.tmp\entitled.vob
- %TEMP%\ixp000.tmp\pst.vob
- %TEMP%\ixp000.tmp\towns.vob
- %TEMP%\ixp000.tmp\685876\listen.scr
- %TEMP%\ixp000.tmp\685876\regasm.exe
- %TEMP%\ixp000.tmp\brief
- %TEMP%\ixp000.tmp\buying
- %TEMP%\ixp000.tmp\campaign
- %TEMP%\ixp000.tmp\dam
- %TEMP%\ixp000.tmp\drilling
- %TEMP%\ixp000.tmp\expensive
- %TEMP%\ixp000.tmp\garcia
- %TEMP%\ixp000.tmp\integer.vob.bat
- %TEMP%\ixp000.tmp\irs
- %TEMP%\ixp000.tmp\prescribed
- %TEMP%\ixp000.tmp\sensitivity
- %TEMP%\ixp000.tmp\undertaken
- %TEMP%\ixp000.tmp\women
Moves the following files
- from %TEMP%\ixp000.tmp\integer.vob to %TEMP%\ixp000.tmp\integer.vob.bat
Network activity
Connects to
- '17#.#6.75.202':80
- 'ip##pi.com':80
- '20#.#66.251.57':4782
TCP
HTTP GET requests
- /storage-15/progr2.7z via 17#.#6.75.202
- http://ip##pi.com/json/
Other
- '20#.#66.251.57':4782
UDP
- DNS ASK ap##########oFmhVfnp.apiXDeehWJgDoFmhVfnp
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%TEMP%\.tmp3ehn8i\progr1.exe'
- '%TEMP%\.tmp3ehn8i\progr2.exe'
- '%TEMP%\ixp000.tmp\685876\listen.scr' y
- '%TEMP%\ixp000.tmp\685876\regasm.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c move Integer.vob Integer.vob.bat && Integer.vob.bat
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\findstr.exe' "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"
- '<SYSTEM32>\extrac32.exe' /Y Pst.vob *.*
- '<SYSTEM32>\findstr.exe' /V "CORRECTLY" Buying
- '<SYSTEM32>\waitfor.exe' /T 5 ZkvdrBbgItDlAEdTFX
- '<SYSTEM32>\at.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c move Integer.vob Integer.vob.bat && Integer.vob.bat' (with hidden window)
