Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SysHelper' = '"%LOCALAPPDATA%\5a95e514-564c-42aa-879c-4baab338c76f\<File name>.exe" --AutoStart'
Creates or modifies the following files
- <SYSTEM32>\tasks\time trigger task
Modifies file system
Creates the following files
- %LOCALAPPDATA%\5a95e514-564c-42aa-879c-4baab338c76f\<File name>.exe
Deletes following files that it created itself
- <SYSTEM32>\tasks\time trigger task
Network activity
Connects to
- 'ap#.2ip.ua':443
- 'ko##b.top':80
TCP
HTTP GET requests
- http://ko##b.top/dl/build2.exe
Other
- 'ap#.2ip.ua':443
UDP
- DNS ASK ap#.2ip.ua
- DNS ASK ko##b.top
- DNS ASK pq##.org
Miscellaneous
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\5a95e514-564c-42aa-879c-4baab338c76f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
- '%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\5a95e514-564c-42aa-879c-4baab338c76f" /deny *S-1-1-0:(OI)(CI)(DE,DC)' (with hidden window)
