Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\dialersvc64
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\AMNBTUSF] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\AMNBTUSF] 'ImagePath' = '%ALLUSERSPROFILE%\xvgxteqheqru\dpvyzlmravzu.exe'
Creates the following services
- 'AMNBTUSF' %ALLUSERSPROFILE%\xvgxteqheqru\dpvyzlmravzu.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\dllhost.exe
- <SYSTEM32>\dialer.exe
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dwm.exe
- <SYSTEM32>\wudfhost.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\sihost.exe
- <SYSTEM32>\taskhostw.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\runtimebroker.exe
- <SYSTEM32>\securityhealthsystray.exe
- <SYSTEM32>\oobe\useroobebroker.exe
- <SYSTEM32>\sc.exe
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\powercfg.exe
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\wbem\wmiprvse.exe
the following user processes:
- iexplore.exe
- firefox.exe
- dpvyzlmravzu.exe
Hooks functions
in browsers
- firefox.exe process, advapi32.dll module
- iexplore.exe process, advapi32.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\dllhost.exe
Modifies file system
Creates the following files
- %TEMP%\_mei45162\vcruntime140.dll
- %TEMP%\_mei45162\_bz2.pyd
- %TEMP%\_mei45162\_cffi_backend.cp311-win_amd64.pyd
- %TEMP%\_mei45162\_ctypes.pyd
- %TEMP%\_mei45162\_decimal.pyd
- %TEMP%\_mei45162\_hashlib.pyd
- %TEMP%\_mei45162\_lzma.pyd
- %TEMP%\_mei45162\_socket.pyd
- %TEMP%\_mei45162\base_library.zip
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\installer
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\metadata
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\record
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\wheel
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\licenses\license
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\licenses\license.apache
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\licenses\license.bsd
- %TEMP%\_mei45162\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei45162\libcrypto-3.dll
- %TEMP%\_mei45162\libffi-8.dll
- %TEMP%\_mei45162\payload.dat
- %TEMP%\_mei45162\python3.dll
- %TEMP%\_mei45162\python311.dll
- %TEMP%\_mei45162\select.pyd
- %TEMP%\_mei45162\unicodedata.pyd
- %TEMP%\gffvshxx
- %TEMP%\qedhbtoy.exe
- %ALLUSERSPROFILE%\xvgxteqheqru\dpvyzlmravzu.exe
- %WINDIR%\temp\__psscriptpolicytest_ocpvyzjf.iyn.ps1
- %WINDIR%\temp\__psscriptpolicytest_e2mczpx0.iba.psm1
- %WINDIR%\temp\__psscriptpolicytest_fpau0nqp.ntv.ps1
- %WINDIR%\temp\__psscriptpolicytest_4ku5txrt.afu.psm1
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-54-795.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-55-042.dump
- %WINDIR%\temp\content\948-5800-powershell.exe-17-18-55-145.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-55-155.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-55-306.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-55-337.dump
- %WINDIR%\temp\__psscriptpolicytest_3s3doj3x.flx.ps1
- %WINDIR%\temp\__psscriptpolicytest_ohgohd0r.l13.psm1
- %WINDIR%\temp\content\948-5800-powershell.exe-17-18-55-455.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-55-521.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-55-552.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-55-590.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-55-652.dump
- %WINDIR%\temp\content\948-5800-powershell.exe-17-18-55-698.dump
- %WINDIR%\temp\content\948-5800-powershell.exe-17-18-55-752.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-55-773.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-55-847.dump
- %WINDIR%\temp\content\948-5800-powershell.exe-17-18-55-908.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-55-962.dump
- %WINDIR%\temp\content\948-5800-powershell.exe-17-18-55-981.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-56-003.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-56-037.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-56-067.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-56-090.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-56-119.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-56-142.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-56-556.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-56-656.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-56-730.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-56-744.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-56-821.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-56-866.dump
- %WINDIR%\temp\content\836-3908-powershell.exe-17-18-57-007.dump
- %WINDIR%\temp\qfjohldufmyc.sys
- %WINDIR%\temp\__psscriptpolicytest_trpb53qf.104.ps1
- %WINDIR%\temp\__psscriptpolicytest_20yp31va.bcp.psm1
- %WINDIR%\temp\content\2016-1484-powershell.exe-17-19-01-901.dump
- %WINDIR%\temp\content\2016-1484-powershell.exe-17-19-02-283.dump
- %WINDIR%\temp\content\2016-1484-powershell.exe-17-19-02-573.dump
- %WINDIR%\temp\content\2016-1484-powershell.exe-17-19-02-620.dump
- %WINDIR%\temp\content\2016-1484-powershell.exe-17-19-02-742.dump
- %WINDIR%\temp\content\2016-1484-powershell.exe-17-19-02-805.dump
Deletes following files that it created itself
- %TEMP%\gffvshxx
- %TEMP%\_mei45162\base_library.zip
- %TEMP%\_mei45162\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\installer
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\licenses\license
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\licenses\license.apache
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\licenses\license.bsd
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\metadata
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\record
- %TEMP%\_mei45162\cryptography-46.0.3.dist-info\wheel
- %TEMP%\_mei45162\libcrypto-3.dll
- %TEMP%\_mei45162\libffi-8.dll
- %TEMP%\_mei45162\payload.dat
- %TEMP%\_mei45162\python3.dll
- %TEMP%\_mei45162\python311.dll
- %TEMP%\_mei45162\select.pyd
- %TEMP%\_mei45162\unicodedata.pyd
- %TEMP%\_mei45162\vcruntime140.dll
- %TEMP%\_mei45162\_bz2.pyd
- %TEMP%\_mei45162\_cffi_backend.cp311-win_amd64.pyd
- %TEMP%\_mei45162\_ctypes.pyd
- %TEMP%\_mei45162\_decimal.pyd
- %TEMP%\_mei45162\_hashlib.pyd
- %TEMP%\_mei45162\_lzma.pyd
- %TEMP%\_mei45162\_socket.pyd
- %WINDIR%\temp\__psscriptpolicytest_ocpvyzjf.iyn.ps1
- %WINDIR%\temp\__psscriptpolicytest_e2mczpx0.iba.psm1
- %WINDIR%\temp\__psscriptpolicytest_fpau0nqp.ntv.ps1
- %WINDIR%\temp\__psscriptpolicytest_4ku5txrt.afu.psm1
- %WINDIR%\temp\__psscriptpolicytest_3s3doj3x.flx.ps1
- %WINDIR%\temp\__psscriptpolicytest_ohgohd0r.l13.psm1
- <SYSTEM32>\tasks\dialersvc64
- %WINDIR%\temp\__psscriptpolicytest_trpb53qf.104.ps1
- %WINDIR%\temp\__psscriptpolicytest_20yp31va.bcp.psm1
Modifies the HOSTS file.
Network activity
UDP
- DNS ASK po##.#ashvault.pro
Miscellaneous
Creates and executes the following
- '%TEMP%\qedhbtoy.exe'
- '%ALLUSERSPROFILE%\xvgxteqheqru\dpvyzlmravzu.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\dialer.exe'
- '<SYSTEM32>\sc.exe' delete "AMNBTUSF"
- '<SYSTEM32>\sc.exe' create "AMNBTUSF" binpath= "%ALLUSERSPROFILE%\xvgxteqheqru\dpvyzlmravzu.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "AMNBTUSF"
- '<SYSTEM32>\dllhost.exe' /Processid:{8bfab7c7-2cf9-4770-a20d-b78980ce6f73}
- '<SYSTEM32>\dllhost.exe' /Processid:{db253b70-5ee1-4cd4-bd61-4691d29cf524}
