Technical Information
Malicious functions
Patches code
in dll
- wwjl.exe process, KERNEL32.dll module
in NTDLL dll
- wwjl.exe process, ntdll.dll module
- runtimebrooker.exe process, ntdll.dll module
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\runtimebrooker.exe
- %TEMP%\1428jocb.bat
Sets the 'hidden' attribute to the following files
- %TEMP%\1428jocb.bat
Network activity
UDP
- DNS ASK ap#.#proyal.com
- DNS ASK fi#####.###tings.services.mozilla.com
Miscellaneous
Creates and executes the following
- '%TEMP%\runtimebrooker.exe' -email=smithhoward232@gmail.com -password=Kamus@1993 -device-name=Machine -accept-tos
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1428JOCB.bat" "<Full path to file>" "
- '%WINDIR%\syswow64\chcp.com' 1252
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\findstr.exe' /I "RuntimeBrooker.exe"
- '%WINDIR%\syswow64\timeout.exe' /T 10
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1428JOCB.bat" "<Full path to file>" "' (with hidden window)
