Technical Information
Triggers a user-defined sigma rule:
- a1a144b7-5c9b-4853-a559-2172be8d4a03
- c09dad97-1c78-4f71-b127-7edb2b8e491a
- f4bbd493-b796-416e-bbf2-121235348529
- 17769c90-230e-488b-a463-e05c08e9d48f
- 81bcb81b-5b1f-474b-b373-52c871aaa7b1
- ce72ef99-22f1-43d4-8695-419dcb5d9330
- 0cfc460b1b267723fd6cb45c14ccc929d9ce2e1ff5952ffe19ca705fed6d4bbe
- 85ff530b-261d-48c6-a441-facaa2e81e48
- 02d1d718-dd13-41af-989d-ea85c7fab93f
- f239b326-2f41-4d6b-9dfa-c846a60ef505
- 5e42535532a60f0f232336336ab4379d1e11719d08d9113447e556537fb7798d
- fa5b1358-b040-4403-9868-15f7d9ab6329
- 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1
- 26481afe-db26-4228-b264-25a29fe6efc7
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\NUXCTTKD] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\NUXCTTKD] 'ImagePath' = '%ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\sejwafmrhmsx.sys'
Creates the following services
- 'NUXCTTKD' %ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\sejwafmrhmsx.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\dialer.exe
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dwm.exe
- <SYSTEM32>\wudfhost.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\sihost.exe
- <SYSTEM32>\taskhostw.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\runtimebroker.exe
- <SYSTEM32>\dllhost.exe
- <SYSTEM32>\securityhealthsystray.exe
- <SYSTEM32>\oobe\useroobebroker.exe
- <SYSTEM32>\wbem\wmiprvse.exe
- <SYSTEM32>\applicationframehost.exe
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\powercfg.exe
- <SYSTEM32>\sc.exe
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\wusa.exe
the following user processes:
- iexplore.exe
- firefox.exe
- decrypted_temp.exe
- cryptor.dll
- 1.exe
- sletikpcfccn.exe
Hooks functions
in browsers
- firefox.exe process, advapi32.dll module
- iexplore.exe process, advapi32.dll module
Patches code
in dll
- dialer.exe process, KERNEL32.dll module
- runtimebroker.exe process, ADVAPI32.dll module
- decrypted_temp.exe process, SECHOST.dll module
- decrypted_temp.exe process, ADVAPI32.dll module
- svchost.exe process, SECHOST.dll module
- svchost.exe process, ADVAPI32.dll module
- cryptor.dll process, SECHOST.dll module
- cryptor.dll process, ADVAPI32.dll module
- powercfg.exe process, SECHOST.dll module
- powercfg.exe process, ADVAPI32.dll module
- sc.exe process, SECHOST.dll module
- sc.exe process, ADVAPI32.dll module
- powershell.exe process, SECHOST.dll module
- powershell.exe process, ADVAPI32.dll module
- cmd.exe process, SECHOST.dll module
- cmd.exe process, ADVAPI32.dll module
- wusa.exe process, SECHOST.dll module
- wusa.exe process, ADVAPI32.dll module
in NTDLL dll
- dialer.exe process, ntdll.dll module
- decrypted_temp.exe process, ntdll.dll module
- svchost.exe process, ntdll.dll module
- cryptor.dll process, ntdll.dll module
- powercfg.exe process, ntdll.dll module
- sc.exe process, ntdll.dll module
- powershell.exe process, ntdll.dll module
- cmd.exe process, ntdll.dll module
- wusa.exe process, ntdll.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\dialer.exe
Modifies file system
Creates the following files
- %TEMP%\_mei51162\crypto\cipher\_arc4.pyd
- %TEMP%\_mei51162\crypto\cipher\_salsa20.pyd
- %TEMP%\_mei51162\crypto\cipher\_chacha20.pyd
- %TEMP%\_mei51162\crypto\cipher\_pkcs1_decode.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_aes.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_aesni.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_arc2.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_blowfish.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_cast.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_cbc.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_cfb.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_ctr.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_des.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_des3.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_ecb.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_ocb.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_ofb.pyd
- %TEMP%\_mei51162\crypto\hash\_blake2b.pyd
- %TEMP%\_mei51162\crypto\hash\_blake2s.pyd
- %TEMP%\_mei51162\crypto\hash\_md2.pyd
- %TEMP%\_mei51162\crypto\hash\_md4.pyd
- %TEMP%\_mei51162\crypto\hash\_md5.pyd
- %TEMP%\_mei51162\crypto\hash\_ripemd160.pyd
- %TEMP%\_mei51162\crypto\hash\_sha1.pyd
- %TEMP%\_mei51162\crypto\hash\_sha224.pyd
- %TEMP%\_mei51162\crypto\hash\_sha256.pyd
- %TEMP%\_mei51162\crypto\hash\_sha384.pyd
- %TEMP%\_mei51162\crypto\hash\_sha512.pyd
- %TEMP%\_mei51162\crypto\hash\_ghash_clmul.pyd
- %TEMP%\_mei51162\crypto\hash\_ghash_portable.pyd
- %TEMP%\_mei51162\crypto\hash\_keccak.pyd
- %TEMP%\_mei51162\crypto\hash\_poly1305.pyd
- %TEMP%\_mei51162\crypto\math\_modexp.pyd
- %TEMP%\_mei51162\crypto\protocol\_scrypt.pyd
- %TEMP%\_mei51162\crypto\publickey\_curve25519.pyd
- %TEMP%\_mei51162\crypto\publickey\_curve448.pyd
- %TEMP%\_mei51162\crypto\publickey\_ec_ws.pyd
- %TEMP%\_mei51162\crypto\publickey\_ed25519.pyd
- %TEMP%\_mei51162\crypto\publickey\_ed448.pyd
- %TEMP%\_mei51162\crypto\util\_cpuid_c.pyd
- %TEMP%\_mei51162\crypto\util\_strxor.pyd
- %TEMP%\_mei51162\vcruntime140.dll
- %TEMP%\_mei51162\vcruntime140_1.dll
- %TEMP%\_mei51162\_asyncio.pyd
- %TEMP%\_mei51162\_bz2.pyd
- %TEMP%\_mei51162\_cffi_backend.cp314-win_amd64.pyd
- %TEMP%\_mei51162\_ctypes.pyd
- %TEMP%\_mei51162\_decimal.pyd
- %TEMP%\_mei51162\_hashlib.pyd
- %TEMP%\_mei51162\_lzma.pyd
- %TEMP%\_mei51162\_multiprocessing.pyd
- %TEMP%\_mei51162\_overlapped.pyd
- %TEMP%\_mei51162\_queue.pyd
- %TEMP%\_mei51162\_socket.pyd
- %TEMP%\_mei51162\_ssl.pyd
- %TEMP%\_mei51162\_wmi.pyd
- %TEMP%\_mei51162\_zstd.pyd
- %TEMP%\_mei51162\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei51162\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei51162\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei51162\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei51162\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei51162\base_library.zip
- %TEMP%\_mei51162\libcrypto-3.dll
- %TEMP%\_mei51162\libffi-8.dll
- %TEMP%\_mei51162\libssl-3.dll
- %TEMP%\_mei51162\pyexpat.pyd
- %TEMP%\_mei51162\python314.dll
- %TEMP%\_mei51162\select.pyd
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei51162\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei51162\ucrtbase.dll
- %TEMP%\_mei51162\unicodedata.pyd
- <Current directory>\decrypted_temp.exe
- %TEMP%\_mei16482\vcruntime140.dll
- %TEMP%\_mei16482\_bz2.pyd
- %TEMP%\_mei16482\_ctypes.pyd
- %TEMP%\_mei16482\_decimal.pyd
- %TEMP%\_mei16482\_hashlib.pyd
- %TEMP%\_mei16482\_lzma.pyd
- %TEMP%\_mei16482\_socket.pyd
- %TEMP%\_mei16482\_ssl.pyd
- %TEMP%\_mei16482\_zstd.pyd
- %TEMP%\_mei16482\base_library.zip
- %TEMP%\_mei16482\libcrypto-3.dll
- %TEMP%\_mei16482\libffi-8.dll
- %TEMP%\_mei16482\libssl-3.dll
- %TEMP%\_mei16482\python314.dll
- %TEMP%\_mei16482\select.pyd
- %TEMP%\_mei16482\unicodedata.pyd
- %TEMP%\gtgi5hld
- %TEMP%\neet_marker.txt
- %TEMP%\tmpq6edpd20\input.exe
- <Current directory>\bluestacks.exe
- %TEMP%\tmpe6ymv3be\cryptor.dll
- %TEMP%\_mei23562\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei23562\vcruntime140.dll
- %TEMP%\_mei23562\vcruntime140_1.dll
- %TEMP%\_mei23562\_asyncio.pyd
- %TEMP%\_mei23562\_bz2.pyd
- %TEMP%\_mei23562\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei23562\_ctypes.pyd
- %TEMP%\_mei23562\_decimal.pyd
- %TEMP%\_mei23562\_hashlib.pyd
- %TEMP%\_mei23562\_lzma.pyd
- %TEMP%\_mei23562\_multiprocessing.pyd
- %TEMP%\_mei23562\_overlapped.pyd
- %TEMP%\_mei23562\_queue.pyd
- %TEMP%\_mei23562\_socket.pyd
- %TEMP%\_mei23562\_sqlite3.pyd
- %TEMP%\_mei23562\_ssl.pyd
- %TEMP%\_mei23562\_wmi.pyd
- %TEMP%\_mei23562\base_library.zip
- %TEMP%\_mei23562\certifi\cacert.pem
- %TEMP%\_mei23562\charset_normalizer\cd.cp313-win_amd64.pyd
- %TEMP%\_mei23562\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei23562\cryptography-48.0.0.dist-info\installer
- %TEMP%\_mei23562\cryptography-48.0.0.dist-info\metadata
- %TEMP%\_mei23562\cryptography-48.0.0.dist-info\record
- %TEMP%\_mei23562\cryptography-48.0.0.dist-info\wheel
- %TEMP%\_mei23562\cryptography-48.0.0.dist-info\licenses\license
- %TEMP%\_mei23562\cryptography-48.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei23562\cryptography-48.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei23562\cryptography-48.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei23562\cryptography-48.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei23562\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei23562\libcrypto-3.dll
- %TEMP%\_mei23562\libffi-8.dll
- %TEMP%\_mei23562\libssl-3.dll
- %TEMP%\_mei23562\psutil\_psutil_windows.pyd
- %TEMP%\_mei23562\pyexpat.pyd
- %TEMP%\_mei23562\python3.dll
- %TEMP%\_mei23562\python313.dll
- %TEMP%\_mei23562\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei23562\select.pyd
- %TEMP%\_mei23562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei23562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei23562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei23562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei23562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei23562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei23562\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei23562\sqlite3.dll
- %TEMP%\_mei23562\unicodedata.pyd
- %TEMP%\_mei23562\win32\win32api.pyd
- %TEMP%\_mei23562\win32\win32clipboard.pyd
- %TEMP%\_mei23562\win32\win32crypt.pyd
- %TEMP%\_mei23562\win32\win32security.pyd
- %TEMP%\cq32e2d1
- %TEMP%\tmpy3axajil\1.exe
- %TEMP%\tmp74yh_mq7\stealer.exe
- %TEMP%\_mei50602\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei50602\pil\_avif.cp313-win_amd64.pyd
- %TEMP%\_mei50602\pil\_imaging.cp313-win_amd64.pyd
- %TEMP%\_mei50602\pil\_imagingcms.cp313-win_amd64.pyd
- %TEMP%\_mei50602\pil\_imagingmath.cp313-win_amd64.pyd
- %TEMP%\_mei50602\pil\_imagingtk.cp313-win_amd64.pyd
- %TEMP%\_mei50602\pil\_webp.cp313-win_amd64.pyd
- %TEMP%\_mei50602\pythonwin\mfc140u.dll
- %TEMP%\_mei50602\pythonwin\win32ui.pyd
- %TEMP%\_mei50602\vcruntime140.dll
- %TEMP%\_mei50602\vcruntime140_1.dll
- %TEMP%\_mei50602\_asyncio.pyd
- %TEMP%\_mei50602\_bz2.pyd
- %TEMP%\_mei50602\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei50602\_ctypes.pyd
- %TEMP%\_mei50602\_decimal.pyd
- %TEMP%\_mei50602\_elementtree.pyd
- %TEMP%\_mei50602\_hashlib.pyd
- %TEMP%\_mei50602\_lzma.pyd
- %TEMP%\_mei50602\_multiprocessing.pyd
- %TEMP%\_mei50602\_overlapped.pyd
- %TEMP%\_mei50602\_queue.pyd
- %TEMP%\_mei50602\_socket.pyd
- %TEMP%\_mei50602\_sqlite3.pyd
- %TEMP%\_mei50602\_ssl.pyd
- %TEMP%\_mei50602\_wmi.pyd
- %TEMP%\_mei50602\base_library.zip
- %TEMP%\_mei50602\certifi\cacert.pem
- %TEMP%\_mei50602\charset_normalizer\cd.cp313-win_amd64.pyd
- %TEMP%\_mei50602\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\installer
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\metadata
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\record
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\wheel
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\licenses\license
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei50602\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei50602\libcrypto-3.dll
- %TEMP%\_mei50602\libffi-8.dll
- %TEMP%\_mei50602\libssl-3.dll
- %TEMP%\_mei50602\psutil\_psutil_windows.pyd
- %TEMP%\_mei50602\pyexpat.pyd
- %TEMP%\_mei50602\python3.dll
- %TEMP%\_mei50602\python313.dll
- %TEMP%\_mei50602\pywin32_system32\pythoncom313.dll
- %TEMP%\_mei50602\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei50602\select.pyd
- %TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei50602\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei50602\sqlite3.dll
- %TEMP%\_mei50602\unicodedata.pyd
- %TEMP%\_mei50602\win32\_win32sysloader.pyd
- %TEMP%\_mei50602\win32\win32api.pyd
- %TEMP%\_mei50602\win32\win32clipboard.pyd
- %TEMP%\_mei50602\win32\win32crypt.pyd
- %TEMP%\_mei50602\win32\win32event.pyd
- %TEMP%\_mei50602\win32\win32security.pyd
- %TEMP%\_mei50602\win32\win32trace.pyd
- %ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe
- %WINDIR%\temp\__psscriptpolicytest_ckgs04i2.hpx.ps1
- %WINDIR%\temp\__psscriptpolicytest_fze0l3es.nci.psm1
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-46-737.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-46-938.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-038.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-185.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-215.dump
- %WINDIR%\temp\__psscriptpolicytest_gpbbf4ie.0ew.ps1
- %WINDIR%\temp\__psscriptpolicytest_xlj1pe2v.jpz.psm1
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-368.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-384.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-437.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-686.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-789.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-874.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-966.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-997.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-018.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-036.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-068.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-083.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-115.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-500.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-553.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-585.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-616.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-638.dump
- %WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-701.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\sejwafmrhmsx.sys
Deletes following files that it created itself
- %TEMP%\_mei51162\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei51162\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei51162\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei51162\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei51162\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei51162\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei51162\base_library.zip
- %TEMP%\_mei51162\crypto\cipher\_arc4.pyd
- %TEMP%\_mei51162\crypto\cipher\_chacha20.pyd
- %TEMP%\_mei51162\crypto\cipher\_pkcs1_decode.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_aes.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_aesni.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_arc2.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_blowfish.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_cast.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_cbc.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_cfb.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_ctr.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_des.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_des3.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_ecb.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_ocb.pyd
- %TEMP%\_mei51162\crypto\cipher\_raw_ofb.pyd
- %TEMP%\_mei51162\crypto\cipher\_salsa20.pyd
- %TEMP%\_mei51162\crypto\hash\_blake2b.pyd
- %TEMP%\_mei51162\crypto\hash\_blake2s.pyd
- %TEMP%\_mei51162\crypto\hash\_ghash_clmul.pyd
- %TEMP%\_mei51162\crypto\hash\_ghash_portable.pyd
- %TEMP%\_mei51162\crypto\hash\_keccak.pyd
- %TEMP%\_mei51162\crypto\hash\_md2.pyd
- %TEMP%\_mei51162\crypto\hash\_md4.pyd
- %TEMP%\_mei51162\crypto\hash\_md5.pyd
- %TEMP%\_mei51162\crypto\hash\_poly1305.pyd
- %TEMP%\_mei51162\crypto\hash\_ripemd160.pyd
- %TEMP%\_mei51162\crypto\hash\_sha1.pyd
- %TEMP%\_mei51162\crypto\hash\_sha224.pyd
- %TEMP%\_mei51162\crypto\hash\_sha256.pyd
- %TEMP%\_mei51162\crypto\hash\_sha384.pyd
- %TEMP%\_mei51162\crypto\hash\_sha512.pyd
- %TEMP%\_mei51162\crypto\math\_modexp.pyd
- %TEMP%\_mei51162\crypto\protocol\_scrypt.pyd
- %TEMP%\_mei51162\crypto\publickey\_curve25519.pyd
- %TEMP%\_mei51162\crypto\publickey\_curve448.pyd
- %TEMP%\_mei51162\crypto\publickey\_ec_ws.pyd
- %TEMP%\_mei51162\crypto\publickey\_ed25519.pyd
- %TEMP%\_mei51162\crypto\publickey\_ed448.pyd
- %TEMP%\_mei51162\crypto\util\_cpuid_c.pyd
- %TEMP%\_mei51162\crypto\util\_strxor.pyd
- %TEMP%\_mei51162\libcrypto-3.dll
- %TEMP%\_mei51162\libffi-8.dll
- %TEMP%\_mei51162\libssl-3.dll
- %TEMP%\_mei51162\pyexpat.pyd
- %TEMP%\_mei51162\python314.dll
- %TEMP%\_mei51162\select.pyd
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei51162\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei51162\ucrtbase.dll
- %TEMP%\_mei51162\unicodedata.pyd
- %TEMP%\_mei51162\vcruntime140.dll
- %TEMP%\_mei51162\vcruntime140_1.dll
- %TEMP%\_mei51162\_asyncio.pyd
- %TEMP%\_mei51162\_bz2.pyd
- %TEMP%\_mei51162\_cffi_backend.cp314-win_amd64.pyd
- %TEMP%\_mei51162\_ctypes.pyd
- %TEMP%\_mei51162\_decimal.pyd
- %TEMP%\_mei51162\_hashlib.pyd
- %TEMP%\_mei51162\_lzma.pyd
- %TEMP%\_mei51162\_multiprocessing.pyd
- %TEMP%\_mei51162\_overlapped.pyd
- %TEMP%\_mei51162\_queue.pyd
- %TEMP%\_mei51162\_socket.pyd
- %TEMP%\_mei51162\_ssl.pyd
- %TEMP%\_mei51162\_wmi.pyd
- %TEMP%\_mei51162\_zstd.pyd
- %TEMP%\gtgi5hld
- %TEMP%\cq32e2d1
- %TEMP%\_mei50602\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei50602\base_library.zip
- %TEMP%\_mei50602\certifi\cacert.pem
- %TEMP%\_mei50602\charset_normalizer\cd.cp313-win_amd64.pyd
- %TEMP%\_mei50602\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei50602\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\installer
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\licenses\license
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\metadata
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\record
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei50602\cryptography-48.0.0.dist-info\wheel
- %TEMP%\_mei50602\libcrypto-3.dll
- %TEMP%\_mei50602\libffi-8.dll
- %TEMP%\_mei50602\libssl-3.dll
- %TEMP%\_mei50602\pil\_avif.cp313-win_amd64.pyd
- %TEMP%\_mei50602\pil\_imaging.cp313-win_amd64.pyd
- %TEMP%\_mei50602\pil\_imagingcms.cp313-win_amd64.pyd
- %TEMP%\_mei50602\pil\_imagingmath.cp313-win_amd64.pyd
- %TEMP%\_mei50602\pil\_imagingtk.cp313-win_amd64.pyd
- %TEMP%\_mei50602\pil\_webp.cp313-win_amd64.pyd
- %TEMP%\_mei50602\psutil\_psutil_windows.pyd
- %TEMP%\_mei50602\pyexpat.pyd
- %TEMP%\_mei50602\python3.dll
- %TEMP%\_mei50602\python313.dll
- %TEMP%\_mei50602\pythonwin\mfc140u.dll
- %TEMP%\_mei50602\pythonwin\win32ui.pyd
- %TEMP%\_mei50602\pywin32_system32\pythoncom313.dll
- %TEMP%\_mei50602\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei50602\select.pyd
- %TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei50602\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei50602\sqlite3.dll
- %TEMP%\_mei50602\unicodedata.pyd
- %TEMP%\_mei50602\vcruntime140.dll
- %TEMP%\_mei50602\vcruntime140_1.dll
- %TEMP%\_mei50602\win32\win32api.pyd
- %TEMP%\_mei50602\win32\win32clipboard.pyd
- %TEMP%\_mei50602\win32\win32crypt.pyd
- %TEMP%\_mei50602\win32\win32event.pyd
- %TEMP%\_mei50602\win32\win32security.pyd
- %TEMP%\_mei50602\win32\win32trace.pyd
- %TEMP%\_mei50602\win32\_win32sysloader.pyd
- %TEMP%\_mei50602\_asyncio.pyd
- %TEMP%\_mei50602\_bz2.pyd
- %TEMP%\_mei50602\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei50602\_ctypes.pyd
- %TEMP%\_mei50602\_decimal.pyd
- %TEMP%\_mei50602\_elementtree.pyd
- %TEMP%\_mei50602\_hashlib.pyd
- %TEMP%\_mei50602\_lzma.pyd
- %TEMP%\_mei50602\_multiprocessing.pyd
- %TEMP%\_mei50602\_overlapped.pyd
- %TEMP%\_mei50602\_queue.pyd
- %TEMP%\_mei50602\_socket.pyd
- %TEMP%\_mei50602\_sqlite3.pyd
- %TEMP%\_mei50602\_ssl.pyd
- %TEMP%\_mei50602\_wmi.pyd
- %WINDIR%\temp\__psscriptpolicytest_ckgs04i2.hpx.ps1
- %WINDIR%\temp\__psscriptpolicytest_fze0l3es.nci.psm1
- %WINDIR%\temp\__psscriptpolicytest_gpbbf4ie.0ew.ps1
- %WINDIR%\temp\__psscriptpolicytest_xlj1pe2v.jpz.psm1
Network activity
Connects to
- 'po##.#ashvault.pro':443
TCP
Other
- 'po##.#ashvault.pro':443
UDP
- DNS ASK po##.#ashvault.pro
Miscellaneous
Searches for the following windows
- ClassName: 'Edit' WindowName: ''
Creates and executes the following
- '<Current directory>\decrypted_temp.exe'
- '%TEMP%\tmpq6edpd20\input.exe'
- '%TEMP%\tmpe6ymv3be\cryptor.dll'
- '%TEMP%\tmpy3axajil\1.exe'
- '%TEMP%\tmp74yh_mq7\stealer.exe'
- '%ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\calc.exe'
- '%ProgramFiles%\windowsapps\microsoft.windowscalculator_10.1906.55.0_x64__8wekyb3d8bbwe\calculator.exe' -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\dialer.exe'
- '<SYSTEM32>\sc.exe' delete "NUXCTTKD"
- '<SYSTEM32>\sc.exe' create "NUXCTTKD" binpath= "%ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "NUXCTTKD"
- '<SYSTEM32>\calc.exe' ' (with hidden window)
- '%TEMP%\tmpq6edpd20\input.exe' ' (with hidden window)
- '%TEMP%\tmpe6ymv3be\cryptor.dll' ' (with hidden window)
- '%TEMP%\tmpy3axajil\1.exe' ' (with hidden window)
- '%TEMP%\tmp74yh_mq7\stealer.exe' ' (with hidden window)
