Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'cfbebacccfcec' = '"%ALLUSERSPROFILE%\cfbebacccfcec.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'System Component Manager' = '%APPDATA%\mucgk\vgayy.exe'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'cfbebacccfcec' = '"%TEMP%\l1etk0pe.exe"'
- [HKCU\Environment] 'UserInitMprLogonScript' = '"<SYSTEM32>\cmd.exe" /c start /b "" "%APPDATA%\Microsoft\Windows\Services\wlrmdr.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OneDriveSync' = '%TEMP%\dxc8616d.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\windows security checks
- <SYSTEM32>\tasks\windows defender security scanner
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Injects code into
the following system processes:
- <SYSTEM32>\notepad.exe
- <SYSTEM32>\sihost.exe
- <SYSTEM32>\taskhostw.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\runtimebroker.exe
the following user processes:
- msedge.exe
Patches code
in dll
- i8j4m4b3.exe process, KERNEL32.dll module
- i8j4m4b3.exe process, KERNELBASE.dll module
- i8j4m4b3.exe process, ADVAPI32.dll module
- i8j4m4b3.exe process, WINHTTP.dll module
- i8j4m4b3.exe process, WININET.dll module
- i8j4m4b3.exe process, SHELL32.dll module
- i8j4m4b3.exe process, USER32.dll module
in AMSI dll
- i8j4m4b3.exe process, Amsi.dll module
- khmlgxcn.exe process, Amsi.dll module
- gnexwtwl.exe process, Amsi.dll module
- rqzerqhm.exe process, Amsi.dll module
- onotivqz.exe process, Amsi.dll module
in NTDLL dll
- i8j4m4b3.exe process, ntdll.dll module
- khmlgxcn.exe process, ntdll.dll module
- gnexwtwl.exe process, ntdll.dll module
- rqzerqhm.exe process, ntdll.dll module
- onotivqz.exe process, ntdll.dll module
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\mozilla\firefox\profiles.ini
Modifies file system
Creates the following files
- <Current directory>\bltools-2.8.3.exe
- %TEMP%\fmkahjc3.exe
- %TEMP%\6fbbe37i.exe
- %TEMP%\i8j4m4b3.exe
- %TEMP%\is-899kic2mrd.tmp\fmkahjc3.tmp
- %TEMP%\cfav88fc.exe
- %TEMP%\l1etk0pe.exe
- %APPDATA%\mucgk\vgayy.exe
- %APPDATA%\microsoft\windows\services\winhost.exe
- %TEMP%\is-d1r924xsq2.tmp\_isetup\_isdecmp.dll
- %ALLUSERSPROFILE%\cfbebacccfcec.exe
- %TEMP%\khmlgxcn.exe
- %TEMP%\gnexwtwl.exe
- %TEMP%\rqzerqhm.exe
- %TEMP%\onotivqz.exe
- %APPDATA%\microsoft\windows\services\wlrmdr.exe
- %TEMP%\vf16q400.exe
- %TEMP%\dxc8616d.exe
- %TEMP%\5cmaz8p9.exe
- %TEMP%\is-1n9l18fh3b.tmp\5cmaz8p9.tmp
- %TEMP%\is-g6rg7ne5pp.tmp\_isetup\_setup64.tmp
- %TEMP%\is-g6rg7ne5pp.tmp\_isetup\_isdecmp.dll
- %TEMP%\3cb8.tmp.exe
- %TEMP%\_mei22602\vcruntime140.dll
- %TEMP%\_mei22602\_bz2.pyd
- %TEMP%\_mei22602\_ctypes.pyd
- %TEMP%\_mei22602\_decimal.pyd
- %TEMP%\_mei22602\_hashlib.pyd
- %TEMP%\_mei22602\_lzma.pyd
- %TEMP%\_mei22602\_socket.pyd
- %TEMP%\_mei22602\_ssl.pyd
- %TEMP%\_mei22602\_zstd.pyd
- %TEMP%\_mei22602\base_library.zip
- %TEMP%\_mei22602\libcrypto-3.dll
- %TEMP%\_mei22602\libffi-8.dll
- %TEMP%\_mei22602\libssl-3.dll
- %TEMP%\_mei22602\python314.dll
- %TEMP%\_mei22602\select.pyd
- %TEMP%\_mei22602\unicodedata.pyd
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt_2h_aat5x.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt_yitws18a.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt_r_2vkz41.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt_2e1gw7ur.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt_n90lqeu1.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt__stbtsds.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt_2zlu13ug.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt_a6afmt1n.tmp
Sets the 'hidden' attribute to the following files
- <Current directory>\bltools-2.8.3.exe
- %TEMP%\fmkahjc3.exe
- %TEMP%\6fbbe37i.exe
- %TEMP%\i8j4m4b3.exe
- %TEMP%\cfav88fc.exe
- %TEMP%\l1etk0pe.exe
- %APPDATA%\mucgk\vgayy.exe
- %APPDATA%\microsoft\windows\services\winhost.exe
- %ALLUSERSPROFILE%\cfbebacccfcec.exe
- %APPDATA%\microsoft\windows\services\wlrmdr.exe
- %TEMP%\dxc8616d.exe
- %TEMP%\5cmaz8p9.exe
Deletes following files that it created itself
- %APPDATA%\microsoft\windows\services\winhost.exe
- %TEMP%\_mei22602\base_library.zip
- %TEMP%\_mei22602\libcrypto-3.dll
- %TEMP%\_mei22602\libffi-8.dll
- %TEMP%\_mei22602\libssl-3.dll
- %TEMP%\_mei22602\python314.dll
- %TEMP%\_mei22602\select.pyd
- %TEMP%\_mei22602\unicodedata.pyd
- %TEMP%\_mei22602\vcruntime140.dll
- %TEMP%\_mei22602\_bz2.pyd
- %TEMP%\_mei22602\_ctypes.pyd
- %TEMP%\_mei22602\_decimal.pyd
- %TEMP%\_mei22602\_hashlib.pyd
- %TEMP%\_mei22602\_lzma.pyd
- %TEMP%\_mei22602\_socket.pyd
- %TEMP%\_mei22602\_ssl.pyd
- %TEMP%\_mei22602\_zstd.pyd
Moves the following files
- from %APPDATA%\microsoft\windows\services\winhost.exe to %APPDATA%\microsoft\windows\services\winhost.exe.slz
Modifies the following files
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt_2h_aat5x.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt_yitws18a.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt_r_2vkz41.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt_2e1gw7ur.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt_n90lqeu1.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt__stbtsds.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt_2zlu13ug.tmp
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt_a6afmt1n.tmp
Substitutes the following files
- %APPDATA%\microsoft\windows\services\winhost.exe
Network activity
Connects to
- '19#.#51.107.186':80
- '19#.#51.107.163':80
- '19#.#62.199.186':80
- '62.##.226.232':80
TCP
HTTP GET requests
- http://19#.#62.199.186/discrete_69.7868.8_INSTALL.exe
- http://62.##.226.232/1.exe
HTTP POST requests
- http://19#.#62.199.186/zpzp/get.php?ui######################################################
- http://19#.#62.199.186/zpzp/get.php?ui#################################################################################
- http://62.##.226.232/zpzp/get.php?ui######################################################
- http://62.##.226.232/zpzp/get.php?ui###############################################################################
Miscellaneous
Creates and executes the following
- '<Current directory>\bltools-2.8.3.exe'
- '%TEMP%\fmkahjc3.exe'
- '%TEMP%\6fbbe37i.exe'
- '%TEMP%\i8j4m4b3.exe'
- '%TEMP%\is-899kic2mrd.tmp\fmkahjc3.tmp' /SL5="$80274,4057916,1011712,%TEMP%\fmkahjc3.exe"
- '%TEMP%\cfav88fc.exe'
- '%TEMP%\l1etk0pe.exe'
- '%TEMP%\khmlgxcn.exe'
- '%TEMP%\gnexwtwl.exe'
- '%TEMP%\rqzerqhm.exe'
- '%TEMP%\onotivqz.exe'
- '%APPDATA%\mucgk\vgayy.exe'
- '%TEMP%\vf16q400.exe'
- '%TEMP%\dxc8616d.exe'
- '%TEMP%\5cmaz8p9.exe'
- '%TEMP%\is-1n9l18fh3b.tmp\5cmaz8p9.tmp' /SL5="$D00D8,2775941,905728,%TEMP%\5cmaz8p9.exe"
- '%TEMP%\3cb8.tmp.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /query /tn "Windows Defender Security Scanner" /fo LIST /v
- '<SYSTEM32>\schtasks.exe' /query /tn "Windows Defender Security Scanner"
- '<SYSTEM32>\schtasks.exe' /create /sc minute /tn "Windows Defender Security Scanner" /tr "%APPDATA%\mucgk\vgayy.exe"
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --no-sandbox
- '<SYSTEM32>\notepad.exe'
- '<SYSTEM32>\schtasks.exe' /query /tn "Windows Defender Security Scanner" /fo LIST /v' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /query /tn "Windows Defender Security Scanner"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /sc minute /tn "Windows Defender Security Scanner" /tr "%APPDATA%\mucgk\vgayy.exe"' (with hidden window)
- '%TEMP%\khmlgxcn.exe' ' (with hidden window)
- '%TEMP%\gnexwtwl.exe' ' (with hidden window)
- '%TEMP%\rqzerqhm.exe' ' (with hidden window)
- '%TEMP%\onotivqz.exe' ' (with hidden window)
- '<SYSTEM32>\notepad.exe' ' (with hidden window)
- '%TEMP%\3cb8.tmp.exe' ' (with hidden window)
