Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"<Full path to file>"'
Creates or modifies the following files
- <SYSTEM32>\tasks\<File name>
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -c "Add-MpPreference -ExclusionPath '<Current directory>' -ExclusionProcess '<File name>.exe'"
Patches code
in AMSI dll
- dpvn.exe process, Amsi.dll module
in NTDLL dll
- dpvn.exe process, ntdll.dll module
Network activity
Connects to
- '<DNS_SERVER>':53
- 'de##.#hvarmsd.com':443
- 'x1.#.lencr.org':80
- '45.#02.1.50':12159
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'de##.#hvarmsd.com':443
- '45.#02.1.50':12159
UDP
- DNS ASK de##.#hvarmsd.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "<File name>" /tr "\"<Full path to file>\"" & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn "<File name>" /tr "\"<Full path to file>\""
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "<File name>" /tr "\"<Full path to file>\"" & exit' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -c "Add-MpPreference -ExclusionPath '<Current directory>' -ExclusionProcess '<File name>.exe'"' (with hidden window)
