Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%TEMP%\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %TEMP%\WinRing0x64.sys
Modifies file system
Creates the following files
- %TEMP%\dilhost.exe
- %TEMP%\4tp92u5g.bat
- nul
Sets the 'hidden' attribute to the following files
- %TEMP%\dilhost.exe
Network activity
Connects to
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- 'xm#.##inrarigs.com':3333
TCP
Other
- 'xm#.##inrarigs.com':3333
UDP
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK xm#.##inrarigs.com
Miscellaneous
Creates and executes the following
- '%TEMP%\dilhost.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\4TP92U5G.bat" "<Full path to file>" "
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\tasklist.exe' /fi "IMAGENAME eq dIlhost.exe"
- '<SYSTEM32>\find.exe' /i "dIlhost.exe"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\4TP92U5G.bat" "<Full path to file>" "' (with hidden window)
