Technical Information
Malicious functions
Injects code into
the following user processes:
- <File name>.exe
Intercepts control using hardware breakpoints
in dll
- vybxc.exe process, USER32.dll module
Searches for windows to
detect analytical utilities:
- ClassName: 'FileMonClass', WindowName: ''
- ClassName: 'RegMonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\bf891517-9349-a24c-93ef-da289eeee53d\<File name>.exe
- %TEMP%\2f55139c.tmp
- %TEMP%\bf891517-9349-a24c-93ef-da289eeee53d\aa_myvb.vbs
- %TEMP%\bf891517-9349-a24c-93ef-da289eeee53d\aa_myjs.js
- %TEMP%\bf891517-9349-a24c-93ef-da289eeee53d\_$$cdesktop.vbs
- %TEMP%\bf891517-9349-a24c-93ef-da289eeee53d\repository.dat
- %TEMP%\570ad868-0f3e-7d42-8c68-999f2e87848c.@@@@
- %TEMP%\0ccf1b74-b26e-b34d-9eae-c43af75df4f0.$$$$
Deletes following files that it created itself
- %TEMP%\570ad868-0f3e-7d42-8c68-999f2e87848c.@@@@
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Nmta'
Creates and executes the following
- '%TEMP%\bf891517-9349-a24c-93ef-da289eeee53d\<File name>.exe' "/AdminEXE "
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\BF891517-9349-A24C-93EF-DA289EEEE53D\AA_MyVB.vbs" "%TEMP%\BF891517-9349-A24C-93EF-DA289EEEE53D\_$$CDesktop.vbs"
Restarts the analyzed sample
