Trojan.Siggen32.43763

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /f /im WindowsServiceHost.exe
'<SYSTEM32>\taskkill.exe' /f /im RMM.Agent.Console.exe
'<SYSTEM32>\taskkill.exe' /f /im "WindowsServiceHost.exe"
'<SYSTEM32>\taskkill.exe' /f /im svcguard.exe

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\windowspowershell\v1.0\powershell.exe

Modifies file system

Creates the following files

<Current directory>\windowsservicehost.exe
%TEMP%\rmm_agent_crash.log
<Current directory>\.installed
%TEMP%\rmm_update_500943de143040f5bb208bef05d4a0c1.zip
%TEMP%\rmm_update_6c717a3f211b4dd9854bef7683d543c2\windowsservicehost.exe
%TEMP%\rmm_update_6c717a3f211b4dd9854bef7683d543c2\rmm.agent.console.exe
%TEMP%\rmm_update_6c717a3f211b4dd9854bef7683d543c2\appsettings.json
%TEMP%\rmm_update_6c717a3f211b4dd9854bef7683d543c2\vcruntime140.dll
<Current directory>\.updating
%TEMP%\51e091aa52fd49f189fbc5d72df20d15.ps1
%TEMP%\rmm_update_69dad836e9fa47278f9b77b7441de718.bat
nul
<Current directory>.rollback\.installed
<Current directory>.rollback\.updating
<Current directory>.rollback\<File name>.exe
<Current directory>.rollback\windowsservicehost.exe
<Current directory>\appsettings.json
<Current directory>\rmm.agent.console.exe
<Current directory>\vcruntime140.dll
%TEMP%\rmm_update_5d88463a7291412f9b82d0e476b48d2b.zip
%TEMP%\rmm_update_79ec37648f444abe8173737193a476de\windowsservicehost.exe
%TEMP%\rmm_update_79ec37648f444abe8173737193a476de\rmm.agent.console.exe
%TEMP%\rmm_update_79ec37648f444abe8173737193a476de\appsettings.json
%TEMP%\rmm_update_79ec37648f444abe8173737193a476de\vcruntime140.dll
%TEMP%\aed6f5472a064ac2a4bb4df6b468df56.ps1
%TEMP%\rmm_update_b3d01381857b40af8d00f8731adf7229.bat
<Current directory>.rollback\appsettings.json
<Current directory>.rollback\rmm.agent.console.exe
<Current directory>.rollback\vcruntime140.dll
%TEMP%\rmm_update_786d28a2ae9141ec9fe63219338c27b5.zip
%TEMP%\rmm_update_653d46c3f951447caeaf434cb8b13497\windowsservicehost.exe
%TEMP%\rmm_update_653d46c3f951447caeaf434cb8b13497\rmm.agent.console.exe
%TEMP%\rmm_update_653d46c3f951447caeaf434cb8b13497\appsettings.json
%TEMP%\rmm_update_653d46c3f951447caeaf434cb8b13497\vcruntime140.dll
%TEMP%\5ab9118695eb4a49a5a6ba569136defb.ps1
%TEMP%\rmm_update_3de1adf617fe4de3be3ec136b104fb06.bat

Deletes following files that it created itself

%TEMP%\51e091aa52fd49f189fbc5d72df20d15.ps1
%TEMP%\aed6f5472a064ac2a4bb4df6b468df56.ps1
%TEMP%\5ab9118695eb4a49a5a6ba569136defb.ps1

Network activity

Connects to

'x1.#.lencr.org':80

TCP

HTTP GET requests

http://x1.#.lencr.org/

Other

'st####galaktika.com':443
'ap#.#pify.org':443

UDP

DNS ASK st####galaktika.com
DNS ASK x1.#.lencr.org
DNS ASK ap#.#pify.org

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'<Current directory>\windowsservicehost.exe' --silent --force
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\51e091aa52fd49f189fbc5d72df20d15.ps1"
'<Current directory>\windowsservicehost.exe' --healthcheck
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\aed6f5472a064ac2a4bb4df6b468df56.ps1"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\5ab9118695eb4a49a5a6ba569136defb.ps1"

Executes the following

'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "<Current directory>\" /t REG_DWORD /d 0 /f
'<SYSTEM32>\icacls.exe' <Current directory> /reset /T /C /Q
'<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_69dad836e9fa47278f9b77b7441de718.bat"
'<SYSTEM32>\chcp.com' 65001
'<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 0 actions= ""/""/""
'<SYSTEM32>\sc.exe' stop "WindowsServiceHost"
'<SYSTEM32>\ping.exe' -n 3 127.0.0.1
'<SYSTEM32>\ping.exe' -n 2 127.0.0.1
'<SYSTEM32>\xcopy.exe' "<Current directory>\*" "<Current directory>.rollback\" /E /Y /Q
'<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_6c717a3f211b4dd9854bef7683d543c2\*" "<Current directory>" /E /Y /Q
'<SYSTEM32>\xcopy.exe' "<Current directory>.rollback\*" "<Current directory>\" /E /Y /Q
'<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 86400 actions= restart/1000/restart/2000/restart/5000
'<SYSTEM32>\sc.exe' failureflag "WindowsServiceHost" 1
'<SYSTEM32>\sc.exe' start "WindowsServiceHost"
'<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_b3d01381857b40af8d00f8731adf7229.bat"
'<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_79ec37648f444abe8173737193a476de\*" "<Current directory>" /E /Y /Q
'<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_3de1adf617fe4de3be3ec136b104fb06.bat"
'<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_653d46c3f951447caeaf434cb8b13497\*" "<Current directory>" /E /Y /Q
'<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_69dad836e9fa47278f9b77b7441de718.bat"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_b3d01381857b40af8d00f8731adf7229.bat"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_3de1adf617fe4de3be3ec136b104fb06.bat"' (with hidden window)