Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%WINDIR%' -ErrorAction SilentlyContinue"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%WINDIR%\Temp' -ErrorAction SilentlyContinue"
Modifies file system
Creates the following files
- %TEMP%\_mei000011b02\vcruntime140.dll
- %TEMP%\_mei000011b02\_bz2.pyd
- %TEMP%\_mei000011b02\_ctypes.pyd
- %TEMP%\_mei000011b02\_decimal.pyd
- %TEMP%\_mei000011b02\_hashlib.pyd
- %TEMP%\_mei000011b02\_lzma.pyd
- %TEMP%\_mei000011b02\_socket.pyd
- %TEMP%\_mei000011b02\_ssl.pyd
- %TEMP%\_mei000011b02\_zstd.pyd
- %TEMP%\_mei000011b02\base_library.zip
- %TEMP%\_mei000011b02\libcrypto-3.dll
- %TEMP%\_mei000011b02\libffi-8.dll
- %TEMP%\_mei000011b02\libssl-3.dll
- %TEMP%\_mei000011b02\python314.dll
- %TEMP%\_mei000011b02\select.pyd
- %TEMP%\_mei000011b02\unicodedata.pyd
Modifies the following files
- %LOCALAPPDATA%\microsoft\penworkspace\discovercachedata.dat
Network activity
Connects to
- 'ap#.##le2send.eu':443
TCP
Other
- 'ap#.##le2send.eu':443
UDP
- DNS ASK ap#.##le2send.eu
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath '%WINDIR%' -ErrorAction SilentlyContinue""
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath '%WINDIR%\Temp' -ErrorAction SilentlyContinue""
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath '%WINDIR%' -ErrorAction SilentlyContinue""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Add-MpPreference -ExclusionPath '%WINDIR%\Temp' -ErrorAction SilentlyContinue""' (with hidden window)
