Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\llama] 'Start' = '00000001'
- [HKLM\SYSTEM\CurrentControlSet\Services\llama] 'ImagePath' = '%TEMP%\llama.sys'
- [HKLM\SYSTEM\CurrentControlSet\Services\llama] 'ImagePath' = '%WINDIR%\TEMP\llama.sys'
- [HKLM\SYSTEM\CurrentControlSet\Services\MicrosoftSoftware2ShadowCop4yProvider] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\MicrosoftSoftware2ShadowCop4yProvider] 'ImagePath' = 'regsvr32.exe /S "%ALLUSERSPROFILE%\Roning\goldendays.dll'
Creates the following services
- 'llama' %TEMP%\\llama.sys
- 'llama' %TEMP%\llama.sys
- 'llama' %WINDIR%\TEMP\\llama.sys
- 'llama' %WINDIR%\TEMP\llama.sys
- 'MicrosoftSoftware2ShadowCop4yProvider' regsvr32.exe /S "%ALLUSERSPROFILE%\Roning\goldendays.dll
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\regsvr32.exe
Modifies file system
Creates the following files
- %TEMP%\llama.sys
- C:\users\public\downloads\20251103113415\hjk.txt
- %WINDIR%\temp\llama.sys
- C:\users\public\downloads\20251103113415\1.bat
- C:\users\public\downloads\20251103113415\fhq.bat
- C:\users\public\downloads\20251103113415\agg.txt
- %ALLUSERSPROFILE%\roning\enpug.bin
- %ALLUSERSPROFILE%\roning\goldendays.dll
- %ALLUSERSPROFILE%\roning\trustinstaller.bin
- %WINDIR%\ewhfvffxuq.bat
- C:\users\public\downloads\20251103113415\kill.txt
- C:\users\public\downloads\20251103113415\1.dll
- <SYSTEM32>\wow64log.dll
- nul
- <SYSTEM32>\codeintegrity\cipolicies\active\{31351756-3f24-4963-8380-4e7602335aae}.cip
Deletes following files that it created itself
- %TEMP%\llama.sys
Network activity
Connects to
- 'localhost':49692
- 'ba##u.com':80
TCP
HTTP GET requests
- http://www.ba##u.com/
Other
- 'localhost':49692
- 'localhost':49693
UDP
- DNS ASK ba##u.com
Miscellaneous
Executes the following
- '<SYSTEM32>\regsvr32.exe' /S "%ALLUSERSPROFILE%\Roning\goldendays.dll
- '<SYSTEM32>\cmd.exe' /C ""%WINDIR%\EWhFVFFXUQ.bat""
- '<SYSTEM32>\tasklist.exe' /fi "PID eq 0"
- '<SYSTEM32>\findstr.exe' /i "0"
- '<SYSTEM32>\timeout.exe' /t 10
- '<SYSTEM32>\cmd.exe' /C ""%WINDIR%\EWhFVFFXUQ.bat""' (with hidden window)
