Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'corehost' = '"%LOCALAPPDATA%\GoogleChrome\corehost.exe"'
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /PID 848 /F
Modifies file system
Creates the following files
- %TEMP%\_mei8482\vcruntime140.dll
- %TEMP%\_mei8482\_asyncio.pyd
- %TEMP%\_mei8482\_bz2.pyd
- %TEMP%\_mei8482\_cffi_backend.cp39-win_amd64.pyd
- %TEMP%\_mei8482\_ctypes.pyd
- %TEMP%\_mei8482\_decimal.pyd
- %TEMP%\_mei8482\_elementtree.pyd
- %TEMP%\_mei8482\_hashlib.pyd
- %TEMP%\_mei8482\_lzma.pyd
- %TEMP%\_mei8482\_multiprocessing.pyd
- %TEMP%\_mei8482\_overlapped.pyd
- %TEMP%\_mei8482\_queue.pyd
- %TEMP%\_mei8482\_socket.pyd
- %TEMP%\_mei8482\_ssl.pyd
- %TEMP%\_mei8482\_uuid.pyd
- %TEMP%\_mei8482\_win32sysloader.pyd
- %TEMP%\_mei8482\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei8482\libcrypto-1_1.dll
- %TEMP%\_mei8482\libffi-7.dll
- %TEMP%\_mei8482\libssl-1_1.dll
- %TEMP%\_mei8482\mfc140u.dll
- %TEMP%\_mei8482\psutil\_psutil_windows.pyd
- %TEMP%\_mei8482\pyexpat.pyd
- %TEMP%\_mei8482\python3.dll
- %TEMP%\_mei8482\python39.dll
- %TEMP%\_mei8482\pywin32_system32\pythoncom39.dll
- %TEMP%\_mei8482\pywin32_system32\pywintypes39.dll
- %TEMP%\_mei8482\select.pyd
- %TEMP%\_mei8482\unicodedata.pyd
- %TEMP%\_mei8482\win32api.pyd
- %TEMP%\_mei8482\win32crypt.pyd
- %TEMP%\_mei8482\win32trace.pyd
- %TEMP%\_mei8482\win32ui.pyd
- %TEMP%\_mei8482\base_library.zip
- %TEMP%\_mei8482\cache\os.py
- %TEMP%\_mei8482\cache\sys.py
- %TEMP%\_mei8482\certifi\cacert.pem
- %TEMP%\_mei8482\cryptography-47.0.0.dist-info\installer
- %TEMP%\_mei8482\cryptography-47.0.0.dist-info\metadata
- %TEMP%\_mei8482\cryptography-47.0.0.dist-info\record
- %TEMP%\_mei8482\cryptography-47.0.0.dist-info\wheel
- %TEMP%\_mei8482\cryptography-47.0.0.dist-info\licenses\license
- %TEMP%\_mei8482\cryptography-47.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei8482\cryptography-47.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei8482\cryptography-47.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei8482\cryptography-47.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei8482\pyarmor_runtime_000000\__init__.py
- %TEMP%\_mei8482\pyarmor_runtime_000000\pyarmor_runtime.pyd
- %TEMP%\l3g8ikso
- %TEMP%\tmphy4w9rvu\gen_py\__init__.py
- %TEMP%\tmphy4w9rvu\gen_py\dicts.dat
- nul
- %TEMP%\microsoft_d03198452124.txt
- %LOCALAPPDATA%\windowsconsole\corehost.exe
- %LOCALAPPDATA%\googlechrome\corehost.exe
Deletes following files that it created itself
- %TEMP%\l3g8ikso
Network activity
Connects to
- 'ap#.#yip.com':443
- 'ti##ok.com':443
- 'gi##ub.com':443
TCP
Other
- 'ap#.#yip.com':443
- 'ti##ok.com':443
- 'gi##ub.com':443
UDP
- DNS ASK ap#.#yip.com
- DNS ASK ti##ok.com
- DNS ASK gi##ub.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq <File name>.exe" /FO CSV /NH
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '<SYSTEM32>\cmd.exe' /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul
- '<SYSTEM32>\reg.exe' QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
- '<SYSTEM32>\cmd.exe' /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul
- '<SYSTEM32>\reg.exe' QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
