Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /PID 3076 /F
Patches code
in dll
- hezhq.exe process, win32u.dll module
in NTDLL dll
- hezhq.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\content\3076-5376-<File name>.exe-20-25-44-453.dump
Network activity
Connects to
- 'de###licker.cc':443
TCP
Other
- 'de###licker.cc':443
UDP
- DNS ASK de###licker.cc
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /C timeout /T 5 /NOBREAK & taskkill /PID 3076 /F & timeout /T 1 /NOBREAK & del "<Full path to file>"
- '<SYSTEM32>\timeout.exe' /T 5 /NOBREAK
- '<SYSTEM32>\timeout.exe' /T 1 /NOBREAK
- '<SYSTEM32>\cmd.exe' /C timeout /T 5 /NOBREAK & taskkill /PID 3076 /F & timeout /T 1 /NOBREAK & del "<Full path to file>"' (with hidden window)
