Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\nvddlkko] 'ImagePath' = '<DRIVERS>\xZ1rGVqvESJZ.sys'
Creates the following services
- 'nvddlkko' <DRIVERS>\xZ1rGVqvESJZ.sys
Modifies file system
Creates the following files
- <DRIVERS>\xz1rgvqvesjz.sys
Deletes following files that it created itself
- <DRIVERS>\7greuufwkkdi.sys
Moves the following files
- from <DRIVERS>\xz1rgvqvesjz.sys to <DRIVERS>\7greuufwkkdi.sys
Network activity
Connects to
- 'mo#####.map.fastly.net':443
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
UDP
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Searches for the following windows
- ClassName: 'VALORANTUnrealWindow' WindowName: ''
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' sc stop nvddlkko
- '<SYSTEM32>\sc.exe' stop nvddlkko
- '<SYSTEM32>\cmd.exe' sc delete nvddlkko
- '<SYSTEM32>\sc.exe' delete nvddlkko
- '<SYSTEM32>\cmd.exe' sc create nvddlkko type= kernel start= demand binPath= <DRIVERS>\xZ1rGVqvESJZ.sys
- '<SYSTEM32>\sc.exe' create nvddlkko type= kernel start= demand binPath= <DRIVERS>\xZ1rGVqvESJZ.sys
- '<SYSTEM32>\cmd.exe' sc start nvddlkko
- '<SYSTEM32>\sc.exe' start nvddlkko
- '<SYSTEM32>\cmd.exe' rename <DRIVERS>\xZ1rGVqvESJZ.sys 7gReUufwkKdI.sys
