Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'DesktopSender' = '<Full path to file>'
Modifies file system
Creates the following files
- %TEMP%\_mei44122\pil\_avif.cp39-win_amd64.pyd
- %TEMP%\_mei44122\pil\_imaging.cp39-win_amd64.pyd
- %TEMP%\_mei44122\pil\_imagingcms.cp39-win_amd64.pyd
- %TEMP%\_mei44122\pil\_imagingmath.cp39-win_amd64.pyd
- %TEMP%\_mei44122\pil\_imagingtk.cp39-win_amd64.pyd
- %TEMP%\_mei44122\pil\_webp.cp39-win_amd64.pyd
- %TEMP%\_mei44122\vcruntime140.dll
- %TEMP%\_mei44122\vcruntime140_1.dll
- %TEMP%\_mei44122\_asyncio.pyd
- %TEMP%\_mei44122\_bz2.pyd
- %TEMP%\_mei44122\_ctypes.pyd
- %TEMP%\_mei44122\_decimal.pyd
- %TEMP%\_mei44122\_elementtree.pyd
- %TEMP%\_mei44122\_hashlib.pyd
- %TEMP%\_mei44122\_lzma.pyd
- %TEMP%\_mei44122\_multiprocessing.pyd
- %TEMP%\_mei44122\_overlapped.pyd
- %TEMP%\_mei44122\_queue.pyd
- %TEMP%\_mei44122\_socket.pyd
- %TEMP%\_mei44122\_sqlite3.pyd
- %TEMP%\_mei44122\_ssl.pyd
- %TEMP%\_mei44122\_uuid.pyd
- %TEMP%\_mei44122\base_library.zip
- %TEMP%\_mei44122\libcrypto-1_1.dll
- %TEMP%\_mei44122\libffi-7.dll
- %TEMP%\_mei44122\libssl-1_1.dll
- %TEMP%\_mei44122\numpy.libs\.load-order-numpy-2.0.2
- %TEMP%\_mei44122\numpy.libs\libscipy_openblas64_-caad452230ae4ddb57899b8b3a33c55c.dll
- %TEMP%\_mei44122\numpy.libs\msvcp140-23ebcc0b37c8e3d074511f362feac48b.dll
- %TEMP%\_mei44122\numpy\_core\_multiarray_tests.cp39-win_amd64.pyd
- %TEMP%\_mei44122\numpy\_core\_multiarray_umath.cp39-win_amd64.pyd
- %TEMP%\_mei44122\numpy\fft\_pocketfft_umath.cp39-win_amd64.pyd
- %TEMP%\_mei44122\numpy\linalg\_umath_linalg.cp39-win_amd64.pyd
- %TEMP%\_mei44122\numpy\random\_bounded_integers.cp39-win_amd64.pyd
- %TEMP%\_mei44122\numpy\random\_common.cp39-win_amd64.pyd
- %TEMP%\_mei44122\numpy\random\_generator.cp39-win_amd64.pyd
- %TEMP%\_mei44122\numpy\random\_mt19937.cp39-win_amd64.pyd
- %TEMP%\_mei44122\numpy\random\_pcg64.cp39-win_amd64.pyd
- %TEMP%\_mei44122\numpy\random\_philox.cp39-win_amd64.pyd
- %TEMP%\_mei44122\numpy\random\_sfc64.cp39-win_amd64.pyd
- %TEMP%\_mei44122\numpy\random\bit_generator.cp39-win_amd64.pyd
- %TEMP%\_mei44122\numpy\random\mtrand.cp39-win_amd64.pyd
- %TEMP%\_mei44122\pyexpat.pyd
- %TEMP%\_mei44122\python39.dll
- %TEMP%\_mei44122\pywin32_system32\pywintypes39.dll
- %TEMP%\_mei44122\select.pyd
- %TEMP%\_mei44122\sqlite3.dll
- %TEMP%\_mei44122\unicodedata.pyd
- %TEMP%\_mei44122\win32\win32pdh.pyd
- %APPDATA%\desktop-sender\sender.log
- %APPDATA%\desktop-sender\config.json
- %APPDATA%\desktop-sender\config.txt
Network activity
Connects to
- 'go###.org.ua':443
- 't.#e':443
- 'fa###ook.com':443
- 'ti##ok.com':443
TCP
Other
- 'go###.org.ua':443
- 'fa###ook.com':443
- 'ti##ok.com':443
UDP
- DNS ASK go###.org.ua
- DNS ASK t.#e
- DNS ASK fa###ook.com
- DNS ASK ti##ok.com
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\wbem\wmic.exe' cpu get Name,NumberOfCores,MaxClockSpeed /format:csv
- '<SYSTEM32>\arp.exe' -a
- '<SYSTEM32>\net.exe' user
- '<SYSTEM32>\net1.exe' user
- '<SYSTEM32>\net.exe' user /domain
- '<SYSTEM32>\net1.exe' user /domain
- '<SYSTEM32>\net.exe' share
- '<SYSTEM32>\net1.exe' share
- '<SYSTEM32>\net.exe' view
- '<SYSTEM32>\wbem\wmic.exe' logicaldisk get Name,Size,FreeSpace,FileSystem /format:csv
- '<SYSTEM32>\ipconfig.exe' /all
- '<SYSTEM32>\route.exe' print
- '<SYSTEM32>\netstat.exe' -ano
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
