Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\Microsoft\Windows\Security\Driver_Modules_1048' = ''
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"%ALLUSERSPROFILE%\Microsoft\Windows\Security\Driver_Modules_1048\""
Modifies file system
Creates the following files
- %TEMP%\runtime_log_20412.txt
- %ALLUSERSPROFILE%\microsoft\windows\security\driver_modules_1048\payload.exe.enc
- %ALLUSERSPROFILE%\microsoft\windows\security\driver_modules_1048\windivert.exe.enc
- %ALLUSERSPROFILE%\microsoft\windows\security\driver_modules_1048\payload.exe
Deletes following files that it created itself
- %ALLUSERSPROFILE%\microsoft\windows\security\driver_modules_1048\payload.exe.enc
Network activity
UDP
- DNS ASK kr##tex.com
- DNS ASK ww####.kryptex.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\microsoft\windows\security\driver_modules_1048\payload.exe'
