Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '9rj4yWh' = '%APPDATA%\BWRN45N45M\hi6V0B9_WKz4zv\9rj4yWh.exe'
Modifies file system
Creates the following files
- %APPDATA%\bwrn45n45m\hi6v0b9_wkz4zv\9rj4ywh.txt
- %APPDATA%\bwrn45n45m\hi6v0b9_wkz4zv\9rj4ywh.exe
- %APPDATA%\bwrn45n45m\hi6v0b9_wkz4zv\xy2dress.dll
- %APPDATA%\bwrn45n45m\hi6v0b9_wkz4zv\libcurl.dll
- %LOCALAPPDATA%\1fcbfbff000606a6
- %APPDATA%\bwrn45n45m\hi6v0b9_wkz4zv\.lnk
Deletes following files that it created itself
- %APPDATA%\bwrn45n45m\hi6v0b9_wkz4zv\.lnk
Network activity
Connects to
- '36##ecc.top':8080
- '36##ecc.top':12345
TCP
HTTP GET requests
- http://36####c.top:8080/10x.dll via 36##ecc.top
Other
- '36##ecc.top':12345
UDP
- DNS ASK 36##ecc.top
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%APPDATA%\bwrn45n45m\hi6v0b9_wkz4zv\9rj4ywh.exe'
Restarts the analyzed sample
Executes the following
- '<Full path to file>' 45063C065A06530675066306740675065A0673067506630674065A0647067606760642066706720667065A065406690667066B066F06680661065A064406510654064806320633064806320633064B065A066E066F0630065006360644063F065...' (with hidden window)
