Trojan.Siggen32.64660

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /f /im WindowsServiceHost.exe
'<SYSTEM32>\taskkill.exe' /f /im RMM.Agent.Console.exe
'<SYSTEM32>\taskkill.exe' /f /im "WindowsServiceHost.exe"
'<SYSTEM32>\taskkill.exe' /f /im svcguard.exe

Modifies file system

Creates the following files

<Current directory>\windowsservicehost.exe
%TEMP%\rmm_agent_crash.log
<Current directory>\.installed
%TEMP%\rmm_update_22a48569a3554e4abf3d24866de058ba.zip
%TEMP%\rmm_update_cec713f33a1b4bb6baa526e8fdda01ea\windowsservicehost.exe
%TEMP%\rmm_update_cec713f33a1b4bb6baa526e8fdda01ea\rmm.agent.console.exe
%TEMP%\rmm_update_cec713f33a1b4bb6baa526e8fdda01ea\appsettings.json
%TEMP%\rmm_update_cec713f33a1b4bb6baa526e8fdda01ea\vcruntime140.dll
<Current directory>\.updating
%TEMP%\06ae2adddb3b45438c6c785b1590c355.ps1
%TEMP%\rmm_update_1a73ae1cd0d044fb89efe4db73898df4.bat
nul
<Current directory>.rollback\.installed
<Current directory>.rollback\.updating
<Current directory>.rollback\<File name>.exe
<Current directory>.rollback\windowsservicehost.exe
<Current directory>\appsettings.json
<Current directory>\rmm.agent.console.exe
<Current directory>\vcruntime140.dll
%TEMP%\rmm_update_8c5e30d8f89541a8b1c277f87805f8d8.zip
%TEMP%\rmm_update_20508ee1f1d5467b888980e98202b295\windowsservicehost.exe
%TEMP%\rmm_update_20508ee1f1d5467b888980e98202b295\rmm.agent.console.exe
%TEMP%\rmm_update_20508ee1f1d5467b888980e98202b295\appsettings.json
%TEMP%\rmm_update_20508ee1f1d5467b888980e98202b295\vcruntime140.dll
%TEMP%\10816f9e53ae4622bed4500fb047a826.ps1
%TEMP%\rmm_update_73639e4ca689473a88b72598c1821ddd.bat
<Current directory>.rollback\appsettings.json
<Current directory>.rollback\rmm.agent.console.exe
<Current directory>.rollback\vcruntime140.dll
%TEMP%\rmm_update_70a9218a213f4429958cef4d3ffdc4e3.zip
%TEMP%\rmm_update_7607df29e1ca44e998d3629992babd3a\windowsservicehost.exe
%TEMP%\rmm_update_7607df29e1ca44e998d3629992babd3a\rmm.agent.console.exe
%TEMP%\rmm_update_7607df29e1ca44e998d3629992babd3a\appsettings.json
%TEMP%\rmm_update_7607df29e1ca44e998d3629992babd3a\vcruntime140.dll
%TEMP%\a9b15cf7751f4ea98e9c06b55715302c.ps1
%TEMP%\rmm_update_0b2aeb25722343db8291053f99f7e859.bat

Deletes following files that it created itself

%TEMP%\06ae2adddb3b45438c6c785b1590c355.ps1
%TEMP%\10816f9e53ae4622bed4500fb047a826.ps1
%TEMP%\a9b15cf7751f4ea98e9c06b55715302c.ps1

Network activity

Connects to

'x1.#.lencr.org':80

TCP

HTTP GET requests

http://x1.#.lencr.org/

Other

'st####galaktika.com':443
'ap#.#pify.org':443

UDP

DNS ASK st####galaktika.com
DNS ASK x1.#.lencr.org
DNS ASK ap#.#pify.org

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'<Current directory>\windowsservicehost.exe' --silent --force
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\06ae2adddb3b45438c6c785b1590c355.ps1"
'<Current directory>\windowsservicehost.exe' --healthcheck
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\10816f9e53ae4622bed4500fb047a826.ps1"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -File "%TEMP%\a9b15cf7751f4ea98e9c06b55715302c.ps1"

Executes the following

'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "<Current directory>\" /t REG_DWORD /d 0 /f
'<SYSTEM32>\icacls.exe' <Current directory> /reset /T /C /Q
'<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_1a73ae1cd0d044fb89efe4db73898df4.bat"
'<SYSTEM32>\chcp.com' 65001
'<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 0 actions= ""/""/""
'<SYSTEM32>\sc.exe' stop "WindowsServiceHost"
'<SYSTEM32>\ping.exe' -n 3 127.0.0.1
'<SYSTEM32>\ping.exe' -n 2 127.0.0.1
'<SYSTEM32>\xcopy.exe' "<Current directory>\*" "<Current directory>.rollback\" /E /Y /Q
'<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_cec713f33a1b4bb6baa526e8fdda01ea\*" "<Current directory>" /E /Y /Q
'<SYSTEM32>\xcopy.exe' "<Current directory>.rollback\*" "<Current directory>\" /E /Y /Q
'<SYSTEM32>\sc.exe' failure "WindowsServiceHost" reset= 86400 actions= restart/1000/restart/2000/restart/5000
'<SYSTEM32>\sc.exe' failureflag "WindowsServiceHost" 1
'<SYSTEM32>\sc.exe' start "WindowsServiceHost"
'<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_73639e4ca689473a88b72598c1821ddd.bat"
'<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_20508ee1f1d5467b888980e98202b295\*" "<Current directory>" /E /Y /Q
'<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_0b2aeb25722343db8291053f99f7e859.bat"
'<SYSTEM32>\xcopy.exe' "%TEMP%\rmm_update_7607df29e1ca44e998d3629992babd3a\*" "<Current directory>" /E /Y /Q
'<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_1a73ae1cd0d044fb89efe4db73898df4.bat"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_73639e4ca689473a88b72598c1821ddd.bat"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "%TEMP%\rmm_update_0b2aeb25722343db8291053f99f7e859.bat"' (with hidden window)