Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' stop "SQLWriter"
- '<SYSTEM32>\net.exe' stop "VSS"
Modifies file system
Creates the following files
- %TEMP%\monitor_log.txt
- %WINDIR%\temp\temp_file.bin
- C:\users\public\documents\data.dat
- %TEMP%\miner_config.json
- %TEMP%\read_me.txt
- nul
- %WINDIR%\temp\svchost_helper.exe
- C:\users\public\runtime_broker.dll
- %ALLUSERSPROFILE%\microsoft\windows\security_logs.bin
- %WINDIR%\temp\processes.txt
Deletes following files that it created itself
- %WINDIR%\temp\temp_file.bin
- C:\users\public\documents\data.dat
- %TEMP%\miner_config.json
- %TEMP%\read_me.txt
- %WINDIR%\temp\svchost_helper.exe
- C:\users\public\runtime_broker.dll
- %ALLUSERSPROFILE%\microsoft\windows\security_logs.bin
Substitutes the following files
- %TEMP%\miner_config.json
- %TEMP%\read_me.txt
Network activity
Connects to
- '<DNS_SERVER>':443
TCP
Other
- '15#.#01.193.91':443
UDP
- DNS ASK google.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c net stop "SQLWriter" >nul 2>&1
- '<SYSTEM32>\net1.exe' stop "SQLWriter"
- '<SYSTEM32>\cmd.exe' /c net stop "VSS" >nul 2>&1
- '<SYSTEM32>\net1.exe' stop "VSS"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-Process | Select-Object Name,CPU,WorkingSet -First 10 | Out-File -FilePath "%WINDIR%\Temp\processes.txt""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-Process | Select-Object Name,CPU,WorkingSet -First 10 | Out-File -FilePath "%WINDIR%\Temp\processes.txt""' (with hidden window)
